1 files changed, 26 insertions, 4 deletions

diff --git a/WebCore/page/DOMSelection.cpp b/WebCore/page/DOMSelection.cpp
index 0d21c56..a583176 100644
--- a/WebCore/page/DOMSelection.cpp
+++ b/WebCore/page/DOMSelection.cpp
@@ -207,6 +207,10 @@ void DOMSelection::collapse(Node* node, int offset, ExceptionCode& ec)
         ec = INDEX_SIZE_ERR;
         return;
     }
+
+    if (!isValidForPosition(node))
+        return;
+
     m_frame->selection()->moveTo(VisiblePosition(node, offset, DOWNSTREAM));
 }
 
@@ -244,6 +248,10 @@ void DOMSelection::setBaseAndExtent(Node* baseNode, int baseOffset, Node* extent
         ec = INDEX_SIZE_ERR;
         return;
     }
+
+    if (!isValidForPosition(baseNode) || !isValidForPosition(extentNode))
+        return;
+
     VisiblePosition visibleBase = VisiblePosition(baseNode, baseOffset, DOWNSTREAM);
     VisiblePosition visibleExtent = VisiblePosition(extentNode, extentOffset, DOWNSTREAM);
 
@@ -258,6 +266,10 @@ void DOMSelection::setPosition(Node* node, int offset, ExceptionCode& ec)
         ec = INDEX_SIZE_ERR;
         return;
     }
+
+    if (!isValidForPosition(node))
+        return;
+
     m_frame->selection()->moveTo(VisiblePosition(node, offset, DOWNSTREAM));
 }
 
@@ -320,14 +332,16 @@ void DOMSelection::extend(Node* node, int offset, ExceptionCode& ec)
         ec = TYPE_MISMATCH_ERR;
         return;
     }
+
     if (offset < 0 || offset > (node->offsetInCharacters() ? caretMaxOffset(node) : (int)node->childNodeCount())) {
         ec = INDEX_SIZE_ERR;
         return;
     }
 
-    SelectionController* selection = m_frame->selection();
-    selection->expandUsingGranularity(CharacterGranularity);
-    selection->setExtent(VisiblePosition(node, offset, DOWNSTREAM));
+    if (!isValidForPosition(node))
+        return;
+
+    m_frame->selection()->setExtent(VisiblePosition(node, offset, DOWNSTREAM));
 }
 
 PassRefPtr<Range> DOMSelection::getRangeAt(int index, ExceptionCode& ec)
@@ -429,7 +443,7 @@ bool DOMSelection::containsNode(const Node* n, bool allowPartial) const
 
     SelectionController* selection = m_frame->selection();
 
-    if (!n || selection->isNone())
+    if (!n || m_frame->document() != n->document() || selection->isNone())
         return false;
 
     Node* parentNode = n->parentNode();
@@ -472,4 +486,12 @@ String DOMSelection::toString()
     return plainText(m_frame->selection()->selection().toNormalizedRange().get());
 }
 
+bool DOMSelection::isValidForPosition(Node* node) const
+{
+    ASSERT(m_frame);
+    if (!node)
+        return true;
+    return node->document() == m_frame->document();
+}
+
 } // namespace WebCore