Avoid using cross RenderView selection rendering

Source/core/editing/FrameSelection.cpp

Index: Source/core/editing/FrameSelection.cpp
diff --git a/Source/core/editing/FrameSelection.cpp b/Source/core/editing/FrameSelection.cpp
index f2f39734097e4d0f606ca191c040efcde9d653d5..1607c89756665d87288c7331d17a1968871cad75 100644
--- a/Source/core/editing/FrameSelection.cpp
+++ b/Source/core/editing/FrameSelection.cpp
@@ -229,8 +229,8 @@ void FrameSelection::setSelection(const VisibleSelection& newSelection, SetSelec
 
     // <http://bugs.webkit.org/show_bug.cgi?id=23464>: Infinite recursion at FrameSelection::setSelection
     // if document->frame() == m_frame we can get into an infinite loop
-    if (s.base().anchorNode()) {
-        Document& document = *s.base().document();
+    if (s.start().anchorNode()) {

[Yuta Kitamura, 2014/04/11 08:59:22]

As far as I know, the relationship among base, extent, start and end is either:
  - (base, extent) = (start, end), or
  - (base, extent) = (end, start)

So, I think this change just flips the coin of crashing condition upside down;
it may prevent some cases from crashing, but will create another chance of
crashes caused by different test cases.

I'm not sure what's the right move here, but it may be worth trying to check
the documents of both ends of |s| and early-exit if they do not match
(assuming the early exit won't cause a severe regression).

Or, VisibleSelection may validate the two ends and nullify itself if
they belong to different documents.

+        Document& document = *s.start().document();
         if (document.frame() && document.frame() != m_frame && document != m_frame->document()) {
             RefPtr<LocalFrame> guard = document.frame();
             document.frame()->selection().setSelection(s, options, align, granularity);