Stale FrameSelection in removed iframe causes crash
https://bugs.webkit.org/show_bug.cgi?id=108696

Reviewed by Ryosuke Niwa.

Source/WebCore:

Catching a specific issue where selectFrameElementInParentIfFullySelected in a nested
iFrame that is removed can leave the outer frame's selection referencing stale nodes.
Instead, in this case, we keep the frame alive long enough to check for this condition
and clear our selection if we hit it.

Test: editing/selection/selection-in-iframe-removed-crash.html

* editing/FrameSelection.cpp:
(WebCore::FrameSelection::setSelection):

LayoutTests:

* editing/selection/selection-in-iframe-removed-crash-expected.txt: Added.
* editing/selection/selection-in-iframe-removed-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@144400 268f45cc-cd09-0410-ab3c-d52691b4dbfc