Check the traversal state in CompositeEditCommand::cloneParagraphUnderNewElement.

CompositeEditCommand::cloneParagraphUnderNewElement(const Position& start, const Position& end, Node* passedOuterNode, Element* blockElement) copies target elements between |start| and |end| to |blockElement|.
This function can crash if it traverses on a strange tree.

The root issue of issue 338558 is that it inserts a node after a node which has no parent.

BUG=338558

Review URL: https://codereview.chromium.org/251723003

git-svn-id: svn://svn.chromium.org/blink/trunk@172967 bbb929c8-8fbe-4397-9dbb-9b2b20218538