Removal of more temporary Range objects.

Source/core/html/HTMLTextAreaElement.cpp

Index: Source/core/html/HTMLTextAreaElement.cpp
diff --git a/Source/core/html/HTMLTextAreaElement.cpp b/Source/core/html/HTMLTextAreaElement.cpp
index 9e1a313567132b987fdbe00c7ee00329cf944f15..e1b1bd215411de5bff82792ddda1c63ffe416b1e 100644
--- a/Source/core/html/HTMLTextAreaElement.cpp
+++ b/Source/core/html/HTMLTextAreaElement.cpp
@@ -300,7 +300,12 @@ void HTMLTextAreaElement::handleBeforeTextInsertedEvent(BeforeTextInsertedEvent*
     // If the text field has no focus, we don't need to take account of the
     // selection length. The selection is the source of text drag-and-drop in
     // that case, and nothing in the text field will be removed.
-    unsigned selectionLength = focused() ? computeLengthForSubmission(plainText(document().frame()->selection().selection().toNormalizedRange().get())) : 0;
+    unsigned selectionLength = 0;
+    if (focused()) {
+        Position start, end;
+        document().frame()->selection().selection().toNormalizedPositions(start, end);
+        selectionLength = computeLengthForSubmission(plainText(start, end));
+    }
     ASSERT(currentLength >= selectionLength);
     unsigned baseLength = currentLength - selectionLength;
     unsigned appendableLength = unsignedMaxLength > baseLength ? unsignedMaxLength - baseLength : 0;