1 files changed, 11 insertions, 5 deletions

diff --git a/Source/WebCore/page/DOMSelection.cpp b/Source/WebCore/page/DOMSelection.cpp
index e119f64d8..064f76837 100644
--- a/Source/WebCore/page/DOMSelection.cpp
+++ b/Source/WebCore/page/DOMSelection.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2009, 2016 Apple Inc. All rights reserved.
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -203,7 +203,7 @@ void DOMSelection::collapse(Node* node, int offset, ExceptionCode& ec)
     if (!isValidForPosition(node))
         return;
 
-    // FIXME: Eliminate legacy editing positions
+    Ref<Frame> protector(*m_frame);
     m_frame->selection().moveTo(createLegacyEditingPosition(node, offset), DOWNSTREAM);
 }
 
@@ -219,6 +219,7 @@ void DOMSelection::collapseToEnd(ExceptionCode& ec)
         return;
     }
 
+    Ref<Frame> protector(*m_frame);
     m_frame->selection().moveTo(selection.end(), DOWNSTREAM);
 }
 
@@ -234,6 +235,7 @@ void DOMSelection::collapseToStart(ExceptionCode& ec)
         return;
     }
 
+    Ref<Frame> protector(*m_frame);
     m_frame->selection().moveTo(selection.start(), DOWNSTREAM);
 }
 
@@ -257,7 +259,7 @@ void DOMSelection::setBaseAndExtent(Node* baseNode, int baseOffset, Node* extent
     if (!isValidForPosition(baseNode) || !isValidForPosition(extentNode))
         return;
 
-    // FIXME: Eliminate legacy editing positions
+    Ref<Frame> protector(*m_frame);
     m_frame->selection().moveTo(createLegacyEditingPosition(baseNode, baseOffset), createLegacyEditingPosition(extentNode, extentOffset), DOWNSTREAM);
 }
 
@@ -273,7 +275,7 @@ void DOMSelection::setPosition(Node* node, int offset, ExceptionCode& ec)
     if (!isValidForPosition(node))
         return;
 
-    // FIXME: Eliminate legacy editing positions
+    Ref<Frame> protector(*m_frame);
     m_frame->selection().moveTo(createLegacyEditingPosition(node, offset), DOWNSTREAM);
 }
 
@@ -324,6 +326,7 @@ void DOMSelection::modify(const String& alterString, const String& directionStri
     else
         return;
 
+    Ref<Frame> protector(*m_frame);
     m_frame->selection().modify(alter, direction, granularity);
 }
 
@@ -345,7 +348,7 @@ void DOMSelection::extend(Node* node, int offset, ExceptionCode& ec)
     if (!isValidForPosition(node))
         return;
 
-    // FIXME: Eliminate legacy editing positions
+    Ref<Frame> protector(*m_frame);
     m_frame->selection().setExtent(createLegacyEditingPosition(node, offset), DOWNSTREAM);
 }
 
@@ -385,6 +388,8 @@ void DOMSelection::addRange(Range* r)
     if (!r)
         return;
 
+    Ref<Frame> protector(*m_frame);
+
     FrameSelection& selection = m_frame->selection();
 
     if (selection.isNone()) {
@@ -433,6 +438,7 @@ void DOMSelection::deleteFromDocument()
     if (!selectedRange)
         return;
 
+    Ref<Frame> protector(*m_frame);
     selectedRange->deleteContents(ASSERT_NO_EXCEPTION);
 
     setBaseAndExtent(&selectedRange->startContainer(), selectedRange->startOffset(), &selectedRange->startContainer(), selectedRange->startOffset(), ASSERT_NO_EXCEPTION);