Element::focus() should acquire the reference of LocalFrame.

Source/core/dom/Element.cpp

Index: Source/core/dom/Element.cpp
diff --git a/Source/core/dom/Element.cpp b/Source/core/dom/Element.cpp
index b69bcd30d4d81d43c05ed5ca03605f1a7d3ff879..7f4bdbdf594e2dc276aa7af299328ff5144ac829 100644
--- a/Source/core/dom/Element.cpp
+++ b/Source/core/dom/Element.cpp
@@ -2154,7 +2154,8 @@ void Element::focus(bool restorePreviousSelection, FocusType type)
 void Element::updateFocusAppearance(bool /*restorePreviousSelection*/)
 {
     if (isRootEditableElement()) {
-        LocalFrame* frame = document().frame();
+        // Taking the ownership since setSelection() may release the last reference to |frame|.
+        RefPtr<LocalFrame> frame(document().frame());
         if (!frame)
             return;