Make Range::processContentsBetweenOffsets() to handle node modification by mutation event handler

This patch changes ASSERT statements for checking |endOffset| inbound in Range::processContentsBetweenOffsets() to limit |endOffset|. This situation can be happened when DOMNodeRemovedFromDocument event handler splits text nodes, Range::insertNode() on text node, in the range calling Range::deleteContents().

This is the last part of fixing issue 240594.

BUG=240594
TEST=LayoutTests/fast/dom/Range/range-delete-contents-mutation-event-crash.html
R=tkent@chromium.org

Review URL: https://codereview.chromium.org/23512006

git-svn-id: svn://svn.chromium.org/blink/trunk@157281 bbb929c8-8fbe-4397-9dbb-9b2b20218538