Set SelectionState w/o propagation at LayoutSelection::Commit().

We reassign SelectionState at the end of LayoutSelection::Commit()
to avoid use-after-free.

This patch changes it to call non virtual
LayoutObject::SetSelectionState() and assign SelectionState
to only target LayoutObjects.

Bug: 739062
Change-Id: I5613257c99332b887501e1bcd4fe27482f9280d0
Reviewed-on: https://chromium-review.googlesource.com/773788Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Commit-Queue: Yoshifumi Inoue <yosin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#517031}

third_party/WebKit/Source/core/editing/LayoutSelection.cpp

@@ -625,12 +625,12 @@ void LayoutSelection::Commit() {
        paint_range_.EndLayoutObject()->GetSelectionState() !=
            SelectionState::kStartAndEnd)) {
     if (paint_range_.StartLayoutObject() == paint_range_.EndLayoutObject()) {
-      paint_range_.StartLayoutObject()->SetSelectionStateIfNeeded(
+      paint_range_.StartLayoutObject()->LayoutObject::SetSelectionState(
           SelectionState::kStartAndEnd);
     } else {
-      paint_range_.StartLayoutObject()->SetSelectionStateIfNeeded(
+      paint_range_.StartLayoutObject()->LayoutObject::SetSelectionState(
           SelectionState::kStart);
-      paint_range_.EndLayoutObject()->SetSelectionStateIfNeeded(
+      paint_range_.EndLayoutObject()->LayoutObject::SetSelectionState(
           SelectionState::kEnd);
     }
   }