FrameSelection::selectAll() should not call selectionFromContentsOfNode() with detached node

third_party/WebKit/Source/core/editing/FrameSelection.cpp

 /*
  * Copyright (C) 2004, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 840 matching lines @@
         if (root) {
             selectStartTarget = root->shadowHost();
         } else {
             root = document->documentElement();
             selectStartTarget = document->body();
         }
     }
     if (!root || editingIgnoresContent(root.get()))
         return;
 
-    if (selectStartTarget && selectStartTarget->dispatchEvent(Event::createCancelableBubble(EventTypeNames::selectstart)) != DispatchEventResult::NotCanceled)
-        return;
+    if (selectStartTarget) {
+        if (selectStartTarget->dispatchEvent(Event::createCancelableBubble(EventTypeNames::selectstart)) != DispatchEventResult::NotCanceled)
+            return;
+        // |root| may be detached due to selectstart event.
+        if (!root->inDocument())

[yosin_UTC9, 2016/03/04 06:06:48]

One more thing, we should check |root| still in same document of FrameSeleciton.
Sorry, I forgot mention this in issue 591001. m(_ _)m

[Xiaocheng, 2016/03/04 06:30:35]

Done.

+            return;
+    }
 
     VisibleSelection newSelection(VisibleSelection::selectionFromContentsOfNode(root.get()));
     setSelection(newSelection);
     selectFrameElementInParentIfFullySelected();
     notifyLayoutObjectOfSelectionChange(UserTriggered);
 }
 
 bool FrameSelection::setSelectedRange(Range* range, TextAffinity affinity, SelectionDirectionalMode directional, SetSelectionOptions options)
 {
     if (!range || !range->inDocument())
@@ skipping 537 matching lines @@
 
 void showTree(const blink::FrameSelection* sel)
 {
     if (sel)
         sel->showTreeForThis();
     else
         fprintf(stderr, "Cannot showTree for (nil) FrameSelection.\n");
 }
 
 #endif