Fix selection related crash in debug build.

BUG=chromium:101435
TEST=manual


Review URL: http://codereview.chromium.org/8413050

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@107838 0039d316-1c4b-4281-b951-d872f2087c98

content/renderer/render_view_impl.cc

@@ -3262,6 +3262,11 @@ void RenderViewImpl::SyncSelectionIfRequired() {
   } else {
     offset = location;
     text = frame->selectionAsText();
+    // http://crbug.com/101435
+    // In some case, frame->selectionAsText() returned text's length is not
+    // equal to the length returned from webview()->caretOrSelectionRange().
+    // So we have to set the range according to text.length().
+    range.set_end(range.start() + text.length());
   }
 
   // Sometimes we get repeated didChangeSelection calls from webkit when