-
inferno@chromium.org authored
https://bugs.webkit.org/show_bug.cgi?id=89762 Reviewed by Ryosuke Niwa. Source/WebCore: RefPtr the innerFrame since it can get destroyed due to mutation event fired in DragController::dispatchTextInputEventFor(). Test: editing/pasteboard/drop-text-events-sideeffect-crash.html * page/DragController.cpp: (WebCore::DragController::concludeEditDrag): LayoutTests: * editing/pasteboard/drop-text-events-sideeffect-crash-expected.txt: Added. * editing/pasteboard/drop-text-events-sideeffect-crash.html: Added. git-svn-id: http://svn.webkit.org/repository/webkit/trunk@121031 268f45cc-cd09-0410-ab3c-d52691b4dbfc
700d6e2a