Merge 94832 - Crashes in WebCore::InsertNodeBeforeCommand constructor.

Merge 94832 - Crashes in WebCore::InsertNodeBeforeCommand constructor.
https://bugs.webkit.org/show_bug.cgi?id=67763

Reviewed by Ryosuke Niwa.

Source/WebCore:

Changes editableRootForPosition() to use the position's containerNode instead of deprecatedNode so that
positions which are before or after a given node cannot return that node as the editable root.

Test: editing/inserting/insert-paragraph-selection-outside-contenteditable.html

* editing/htmlediting.cpp:
(WebCore::editableRootForPosition): use containerNode instead of deprecatedNode.

LayoutTests:

Tests for crash when the selection is outside the contenteditable node.

* editing/inserting/insert-paragraph-selection-outside-contenteditable-expected.txt: Added.
* editing/inserting/insert-paragraph-selection-outside-contenteditable.html: Added.


TBR=sullivan@chromium.org
BUG=95550
Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=94880