Index: Source/core/dom/Range.cpp |
diff --git a/Source/core/dom/Range.cpp b/Source/core/dom/Range.cpp |
index 645bdf5cbeedac7db4fe83c644799172e78acaa1..d211ca03c2abfaa9090bd2ed705809f9442b6bd2 100644 |
--- a/Source/core/dom/Range.cpp |
+++ b/Source/core/dom/Range.cpp |
@@ -895,11 +895,13 @@ void Range::insertNode(PassRefPtrWillBeRawPtr<Node> prpNewNode, ExceptionState& |
return; |
container = m_start.container(); |
+ // When |newNode| is IFRAME, |newText| can be removed from current |
+ // document by "load" event handler. |
container->parentNode()->insertBefore(newNode.release(), newText.get(), exceptionState); |
if (exceptionState.hadException()) |
return; |
- if (collapsed) |
+ if (collapsed && newText->parentNode()) |
m_end.setToBeforeChild(*newText); |
} else { |
RefPtrWillBeRawPtr<Node> lastChild = (newNodeType == Node::DOCUMENT_FRAGMENT_NODE) ? toDocumentFragment(newNode)->lastChild() : newNode.get(); |