The FrameSelection::m_previousCaretNode may hold onto a Node inside the document with the selection. Merge https://chromium.googlesource.com/chromium/blink/+/b908cb4c8da93316d787de31c93f2a43de332a10
Created attachment 207505 [details] Fixes the bug
<rdar://problem/14556358>
Clearly, this is a regression from http://trac.webkit.org/changeset/146403.
Rather http://trac.webkit.org/changeset/139282.
Committed r153366: <http://trac.webkit.org/changeset/153366>
The test added here is super flaky (maybe b/f cache)? I can reproduce locally with run-webkit-tests editing/selection/leak-document-with-selection-inside.html --repeat-each 2
Added a gc() call in <http://trac.webkit.org/r153498>, let's see how much this helps.
(In reply to comment #7) > Added a gc() call in <http://trac.webkit.org/r153498>, let's see how much > this helps. Test is flaking a bit more in June 2015: Bug 146182: editing/selection/leak-document-with-selection-inside.html is flaky (always fails on Apple Win 7) <https://bugs.webkit.org/show_bug.cgi?id=146182>