Fixing crash when executing InsertOrderedList execCommand.

In applyInlineStyleToNodeRange(), a call to removeConflictingInlineStyleFromRun() can modify the start and end Nodes of InlineRunToApplyStyle.

For the crash scenario, the start node being set in removeConflictingInlineStyleFromRun() is invalid and further use of it when calling positionToComputeInlineStyleChange() causes a crash.

Thus adding a check for startAndEndAreStillInDocument() fixes the crash. However, since for the invalid scenario positionForStyleComputation shall not be set, we should check for it's validity before using the same for creating the StyleChange object.

Have added a testcase based on the simplified clusterfuzz testcase added by yoichio in http://crbug.com/343799 which verifies the crash.

BUG=343799

Review URL: https://codereview.chromium.org/181103004

git-svn-id: svn://svn.chromium.org/blink/trunk@168278 bbb929c8-8fbe-4397-9dbb-9b2b20218538