LibWeb: Only set selection focus if an associated DOM node was found

The relation from a paintable to a DOM node is not always set.

Libraries/LibWeb/Page/EventHandler.cpp

@@ -596,9 +596,8 @@ EventResult EventHandler::handle_mousemove(CSSPixelPoint viewport_position, CSSP
         if (m_in_mouse_selection) {
             auto hit = paint_root()->hit_test(viewport_position, Painting::HitTestType::TextCursor);
             if (m_mouse_selection_target) {
-                if (hit.has_value()) {
+                if (hit.has_value() && hit->paintable->dom_node())
                     m_mouse_selection_target->set_selection_focus(*hit->paintable->dom_node(), hit->index_in_node);
-                }
             } else {
                 if (start_index.has_value() && hit.has_value() && hit->dom_node()) {
                     if (auto selection = document.get_selection()) {

Tests/LibWeb/Text/expected/Editing/selection-in-contenteditable-crash-regression.txt

@@ -0,0 +1 @@
+PASS (did not crash)

Tests/LibWeb/Text/input/Editing/selection-in-contenteditable-crash-regression.html

@@ -0,0 +1,19 @@
+<script src="../include.js"></script>
+<style>
+    div {
+        font-size: 10px;
+    }
+</style>
+<div contenteditable="true">a<br><br><div id="b">b</div></div>
+<script>
+    test(() => {
+        var bDiv = document.querySelector('div#b');
+        var bBounds = bDiv.getBoundingClientRect();
+
+        // Drag a selection from inside the #b div to just above it.
+        internals.mouseDown(bBounds.x + 2, bBounds.y + 5);
+        internals.movePointerTo(bBounds.x + 2, bBounds.y - 5);
+
+        println('PASS (did not crash)');
+    });
+</script>