Fix crash when node is moved in a selection

LayoutTests/editing/selection/move-node-in-selection-crash.html

Index: LayoutTests/editing/selection/move-node-in-selection-crash.html
diff --git a/LayoutTests/editing/selection/move-node-in-selection-crash.html b/LayoutTests/editing/selection/move-node-in-selection-crash.html
new file mode 100644
index 0000000000000000000000000000000000000000..4c29bcea3d083afc51aa94e06c5d6ad294ecdb7b
--- /dev/null
+++ b/LayoutTests/editing/selection/move-node-in-selection-crash.html
@@ -0,0 +1,31 @@
+<style>
+.c2 + .c9 { position: fixed; height: 1px; }

[leviw_travelin_and_unemployed, 2014/08/11 23:03:13]

Can we remove c2 altogether and just leave the c9 selector?

[Xianzhu, 2014/08/12 17:32:40]

Done.

+.c5 { position: fixed; padding-bottom: 1px; padding-left: 100%; -webkit-column-span: all; }
+.c16 { display: -webkit-box; }

[leviw_travelin_and_unemployed, 2014/08/11 23:03:13]

How about giving these classes descriptive names?

[Xianzhu, 2014/08/12 17:32:40]

Now using tag names in the selectors.

+</style>
+<script>
+if (window.testRunner)
+  testRunner.dumpAsText();
+
+window.onload = function() {
+  var sup = document.createElement('sup');
+  var hgroup = document.createElement('hgroup');
+  var samp = document.createElement('samp');
+  var figcaption = document.createElement('figcaption');
+  var legend = document.createElement('legend');

[leviw_travelin_and_unemployed, 2014/08/11 23:03:13]

Are these odd types necessary?

[Xianzhu, 2014/08/12 17:32:40]

Tried to remove any of them and the crash couldn't reproduce.
Anyway changed their names to be more descriptive.

+  legend.setAttribute('class', 'c2');
+  document.documentElement.appendChild(legend);
+  var p = document.createElement('p');
+  p.setAttribute('class', 'c9');
+  document.documentElement.appendChild(p);
+  document.execCommand('SelectAll', '');
+  p.appendChild(hgroup);
+  sup.setAttribute('class', 'c16');
+  p.appendChild(samp);
+  hgroup.setAttribute('class', 'c5');
+  samp.appendChild(sup);
+  document.body.offsetHeight;
+  figcaption.appendChild(sup);
+};
+</script>
+This is modified from a cluster-fuzz test case. Passes if no crash.