Fix out-of-date offset in selection range code.

Code in Range::insertNode assumes that the start offset of the selection
range within its container does not change across a call to insertBefore
on the container, which is not true. This patch recomputes the start
offset when it is used after the insertBefore call.

R=ojan@chromium.org, infernosec, ojan
BUG=299993

Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=158859

Review URL: https://codereview.chromium.org/25571006

git-svn-id: svn://svn.chromium.org/blink/trunk@158989 bbb929c8-8fbe-4397-9dbb-9b2b20218538