Bug 1685153 - Null check mBoundFrame before scrolling to it. r=masayuki

SetSelectionRange may kill the frame (in the test-case, AccessibleCaret
flushes layout).

No crashtest as there doesn't seem to be one available.

Differential Revision: https://phabricator.services.mozilla.com/D101253

dom/html/TextControlState.cpp

@@ -2096,7 +2096,9 @@ void TextControlState::SetSelectionRange(
         handlingSetSelectionRange.IsTextControlStateDestroyed()) {
       return;
     }
-    if (aScroll == ScrollAfterSelection::Yes) {
+    if (aScroll == ScrollAfterSelection::Yes && mBoundFrame) {
+      // mBoundFrame could be gone if selection listeners flushed layout for
+      // example.
       mBoundFrame->ScrollSelectionIntoViewAsync();
     }
     // Press on to firing the event even if that failed, like our old code did.