Let Range::expand not crash when Range's start node is not connected to document.

third_party/WebKit/Source/core/dom/Range.cpp

Index: third_party/WebKit/Source/core/dom/Range.cpp
diff --git a/third_party/WebKit/Source/core/dom/Range.cpp b/third_party/WebKit/Source/core/dom/Range.cpp
index 45618228a553fb8b3721f8e7b738d8269220a468..938dfec2fd5f1c6284af20b88ace609fa7d671b0 100644
--- a/third_party/WebKit/Source/core/dom/Range.cpp
+++ b/third_party/WebKit/Source/core/dom/Range.cpp
@@ -1644,8 +1644,9 @@ void Range::didSplitTextNode(const Text& oldNode) {
 }
 
 void Range::expand(const String& unit, ExceptionState& exceptionState) {
+  if (!startPosition().isConnected() || !endPosition().isConnected())
+    return;
   m_ownerDocument->updateStyleAndLayoutIgnorePendingStylesheets();
-
   VisiblePosition start = createVisiblePosition(startPosition());
   VisiblePosition end = createVisiblePosition(endPosition());
   if (unit == "word") {