Fix a crash caused by invalid selection set by Undo command.

Undo command resets the selection to the previous position, but under some
conditions it may set the selection to a position in a document that is not
controlled by FrameSelection.

If this happens, a subsequent call of FindString command provokes an assertion
in TextIterator, as it does not expect the selection endpoints to be in another
document.

This patch fixes the issue and adds a layout test that reproduces the assertion
failure.

BUG=374904

Review URL: https://codereview.chromium.org/326323003

git-svn-id: svn://svn.chromium.org/blink/trunk@176010 bbb929c8-8fbe-4397-9dbb-9b2b20218538