Fix crash in CompositeEditCommand::cloneParagraphUnderNewElement().

Fix crash in CompositeEditCommand::cloneParagraphUnderNewElement().

The root cause is CompositeEditCommand::moveParagraphWithClones() passing
two positions |start| and |end| which do not follow the document order,
i.e. in some situations |start| is located after |end| because of
the difference in affinity.

This patch fixes this crash by normalizing |end| to |start| in such situations.
It also adds an ASSERT that checks the relationship between |start| and |end|.

BUG=345005
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=168160

[yoichio, 2014-02-27 05:08:31]

lgtm

[Yuta Kitamura, 2014-02-27 11:19:56]

+Levi, can you take a look?

[Yuta Kitamura, 2014-02-28 03:30:58]

Anyone from OWNERS?

[leviw_travelin_and_unemployed, 2014-02-28 18:22:28]

Great! LGTM!

[leviw_travelin_and_unemployed, 2014-02-28 18:22:32]

The CQ bit was checked by leviw@chromium.org

[commit-bot: I haz the power, 2014-02-28 18:23:25]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/yutak@chromium.org/182533004/1

[commit-bot: I haz the power, 2014-02-28 19:32:37]

Change committed as 168160