Don't over split DOM tree in CompositeEditCommand::splitTreeToNode

This patch changes CompositeEditCommand::splitTreeToNode not to split when
tree parent parameter |start| isn't descendant of |end| node parameter.

The root cause of issue 350843 is we call |positionInParentAfterNode()| with
dangling BLOCKQUOTE element which is tried to insert HTML element as result
of |splitTreeNode()|, which is called BODY element, and HR element; HR element
is child of BODY element.

BUG=350843
TEST=LayoutTests/editing/execCommand/indent-table-cell-crash.html

Review URL: https://codereview.chromium.org/306473003

git-svn-id: svn://svn.chromium.org/blink/trunk@174951 bbb929c8-8fbe-4397-9dbb-9b2b20218538