Avoid using cross RenderView selection rendering

Source/core/editing/FrameSelection.cpp

 /*
  * Copyright (C) 2004, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 211 matching lines @@
     if (shouldAlwaysUseDirectionalSelection(m_frame))
         s.setIsDirectional(true);
 
     if (!m_frame) {
         m_selection = s;
         return;
     }
 
     // <http://bugs.webkit.org/show_bug.cgi?id=23464>: Infinite recursion at FrameSelection::setSelection
     // if document->frame() == m_frame we can get into an infinite loop
-    if (s.base().anchorNode()) {
-        Document& document = *s.base().document();
+    if (s.start().anchorNode()) {

[Yuta Kitamura, 2014/04/11 08:59:22]

As far as I know, the relationship among base, extent, start and end is either:
  - (base, extent) = (start, end), or
  - (base, extent) = (end, start)

So, I think this change just flips the coin of crashing condition upside down;
it may prevent some cases from crashing, but will create another chance of
crashes caused by different test cases.

I'm not sure what's the right move here, but it may be worth trying to check
the documents of both ends of |s| and early-exit if they do not match
(assuming the early exit won't cause a severe regression).

Or, VisibleSelection may validate the two ends and nullify itself if
they belong to different documents.

+        Document& document = *s.start().document();
         if (document.frame() && document.frame() != m_frame && document != m_frame->document()) {
             RefPtr<LocalFrame> guard = document.frame();
             document.frame()->selection().setSelection(s, options, align, granularity);
             // It's possible that during the above set selection, this FrameSelection has been modified by
             // selectFrameElementInParentIfFullySelected, but that the selection is no longer valid since
             // the frame is about to be destroyed. If this is the case, clear our selection.
             if (guard->hasOneRef() && !m_selection.isNonOrphanedCaretOrRange())
                 clear();
             return;
         }
@@ skipping 1632 matching lines @@
     sel.showTreeForThis();
 }
 
 void showTree(const WebCore::FrameSelection* sel)
 {
     if (sel)
         sel->showTreeForThis();
 }
 
 #endif