Sorry I don't understand this issue. Can we have an offline discussion?

void FrameSelection::selectAll()
{
...
 root = ...

   if (selectStartTarget && selectStartTarget->dispatchEvent(Event::createCancelableBubble(EventTypeNames::selectstart)) != DispatchEventResult::NotCanceled)
        return;
   // |root| may be removed
  VisibleSelection newSelection(VisibleSelection::selectionFromContentsOfNode(root.get()));
  // selectionFromContentsOfNode() is called with removed |root|

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/f52d88ac2c0e7814a7af9250f7cb89d6134794ae

commit f52d88ac2c0e7814a7af9250f7cb89d6134794ae
Author: xiaochengh <xiaochengh@chromium.org>
Date: Fri Mar 04 08:25:11 2016

FrameSelection::selectAll() should not call selectionFromContentsOfNode() with detached node

BUG= 591001 

Review URL: https://codereview.chromium.org/1768483002

Cr-Commit-Position: refs/heads/master@{#379247}

[modify] https://crrev.com/f52d88ac2c0e7814a7af9250f7cb89d6134794ae/third_party/WebKit/Source/core/editing/FrameSelection.cpp