Bug 842132 - Crash with contentEditable, selection.deleteFromDocument with overlapping selection ranges, r=tbsaunde