Fix crash when node is moved in a selection

LayoutTests/editing/selection/move-node-in-selection-crash.html

+<style>
+p { position: fixed; height: 1px; }
+hgroup { position: fixed; padding-bottom: 1px; padding-left: 100%; -webkit-column-span: all; }
+sup { display: -webkit-box; }
+</style>
+<script>
+if (window.testRunner)
+  testRunner.dumpAsText();
+
+window.onload = function() {
+  document.documentElement.appendChild(document.createElement('span'));
+  var grandparent = document.createElement('p');
+  document.documentElement.appendChild(grandparent);
+  document.execCommand('SelectAll', '');
+
+  grandparent.appendChild(document.createElement('hgroup'));
+  var oldParent = document.createElement('span');
+  grandparent.appendChild(oldParent);
+  var childToMove = document.createElement('sup');
+  oldParent.appendChild(childToMove);
+
+  document.body.offsetHeight;
+
+  // Move childToMove under the orphaned parent.
+  var orphanedParent = document.createElement('div');
+  orphanedParent.appendChild(childToMove);
+};
+</script>
+This is modified from a cluster-fuzz test case. Passes if no crash.