3 files changed, 23 insertions, 3 deletions
diff --git a/Source/WebKit/android/jni/JavaSharedClient.cpp b/Source/WebKit/android/jni/JavaSharedClient.cpp
index e884c99..4f40355 100644
--- a/Source/WebKit/android/jni/JavaSharedClient.cpp
+++ b/Source/WebKit/android/jni/JavaSharedClient.cpp
@@ -117,7 +117,7 @@ namespace android {
             void (*proc)(void*) = 0;
             void* payload = 0;
             const FuncPtrRec* rec;
-            
+
             // we have to copy the proc/payload (if present). we do this so we
             // don't call the proc inside the mutex (possible deadlock!)
             gFuncPtrQMutex.acquire();
@@ -128,7 +128,7 @@ namespace android {
                 gFuncPtrQ.pop_front();
             }
             gFuncPtrQMutex.release();
-            
+
             if (!rec)
                 break;
             proc(payload);
diff --git a/Source/WebKit/android/jni/WebViewCore.cpp b/Source/WebKit/android/jni/WebViewCore.cpp
index 8b2029f..24266f6 100644
--- a/Source/WebKit/android/jni/WebViewCore.cpp
+++ b/Source/WebKit/android/jni/WebViewCore.cpp
@@ -2189,6 +2189,11 @@ void WebViewCore::setSelection(int start, int end)
 String WebViewCore::modifySelection(const int direction, const int axis)
 {
     DOMSelection* selection = m_mainFrame->domWindow()->getSelection();
+    ASSERT(selection);
+    // We've seen crashes where selection is null, but we don't know why
+    // See http://b/5244036
+    if (!selection)
+        return String();
     if (selection->rangeCount() > 1)
         selection->removeAllRanges();
     switch (axis) {
diff --git a/Source/WebKit/android/nav/WebView.cpp b/Source/WebKit/android/nav/WebView.cpp
index 3522627..101e206 100644
--- a/Source/WebKit/android/nav/WebView.cpp
+++ b/Source/WebKit/android/nav/WebView.cpp
@@ -512,8 +512,23 @@ bool drawGL(WebCore::IntRect& viewRect, WebCore::IntRect* invalRect, WebCore::In
     m_glWebViewState->resetRings();
     if (extra) {
         if (extra == &m_ring) {
+            WTF::Vector<IntRect> rings;
             if (root == m_ring.m_frame)
-                m_glWebViewState->setRings(m_ring.rings(), m_ring.m_isPressed);
+                rings = m_ring.rings();
+            else {
+                // TODO: Fix the navcache to work with layers correctly
+                // In the meantime, this works around the bug. However, the rings
+                // it produces are not as nice for some reason, thus we use
+                // m_ring.rings() above for the base layer instead of the below
+                for (size_t i = 0; i < m_ring.m_node->rings().size(); i++) {
+                    IntRect rect = m_ring.m_node->rings().at(i);
+                    rect = m_ring.m_frame->adjustBounds(m_ring.m_node, rect);
+                    rect.inflate(4);
+                    rings.append(rect);
+                }
+            }
+            m_glWebViewState->setRings(rings, m_ring.m_isPressed);
+            extra = 0;
         } else {
             LayerAndroid mainPicture(m_navPictureUI);
             PictureSet* content = m_baseLayer->content();