Fix crash in CompositeEditCommand::cloneParagraphUnderNewElement().

The root cause is CompositeEditCommand::moveParagraphWithClones() passing
two positions |start| and |end| which do not follow the document order,
i.e. in some situations |start| is located after |end| because of
the difference in affinity.

This patch fixes this crash by normalizing |end| to |start| in such situations.
It also adds an ASSERT that checks the relationship between |start| and |end|.

BUG=345005

Review URL: https://codereview.chromium.org/182533004

git-svn-id: svn://svn.chromium.org/blink/trunk@168160 bbb929c8-8fbe-4397-9dbb-9b2b20218538