Check VisualPosition.isNull() after the DOM mutation in ReplaceSelectionCommand

The crash is on L1125, calling insertNodeAt with the Null VisualPosition, startOfInsertedContent.
It inserts a <br> element to the selected position but the replacing might change visual position so we should check.

BUG=348283

Review URL: https://codereview.chromium.org/183893018

git-svn-id: svn://svn.chromium.org/blink/trunk@168502 bbb929c8-8fbe-4397-9dbb-9b2b20218538