FrameSelection::selectAll() should not call selectionFromContentsOfNode() with detached node

third_party/WebKit/Source/core/editing/FrameSelection.cpp

Index: third_party/WebKit/Source/core/editing/FrameSelection.cpp
diff --git a/third_party/WebKit/Source/core/editing/FrameSelection.cpp b/third_party/WebKit/Source/core/editing/FrameSelection.cpp
index 22fe9fbd89ee7dfd71d6c9b437dac1f27085536b..33018ec8241cba10c255bcd5fdc8b43da678c297 100644
--- a/third_party/WebKit/Source/core/editing/FrameSelection.cpp
+++ b/third_party/WebKit/Source/core/editing/FrameSelection.cpp
@@ -858,8 +858,13 @@ void FrameSelection::selectAll()
     if (!root || editingIgnoresContent(root.get()))
         return;
 
-    if (selectStartTarget && selectStartTarget->dispatchEvent(Event::createCancelableBubble(EventTypeNames::selectstart)) != DispatchEventResult::NotCanceled)
-        return;
+    if (selectStartTarget) {
+        if (selectStartTarget->dispatchEvent(Event::createCancelableBubble(EventTypeNames::selectstart)) != DispatchEventResult::NotCanceled)
+            return;
+        // |root| may be detached due to selectstart event.
+        if (!root->inDocument())

[yosin_UTC9, 2016/03/04 06:06:48]

One more thing, we should check |root| still in same document of FrameSeleciton.
Sorry, I forgot mention this in issue 591001. m(_ _)m

[Xiaocheng, 2016/03/04 06:30:35]

Done.

+            return;
+    }
 
     VisibleSelection newSelection(VisibleSelection::selectionFromContentsOfNode(root.get()));
     setSelection(newSelection);