Bug 1477527: window.getSelection() into a text input can trigger application crash

Instructions: text select/highlight by dragging with the mouse any part of the text in the orange-bordered input.

Actual results in Firefox 52.9.0 ESR buildID=20180626223325: APPLICATION CRASH

Actual results in Firefox 63.0a1 buildID=20180721220720: the whole text in the orange-bordered input disappears.

Expected results: the highlighted text replaces the whole text in the orange-bordered input.

Chromium 67.0.3396.87 and Opera 56.0.3013.0 (Edition developer; Chrome/69.0.3472.3) achieve expected results.