Fix crash when node is moved in a selection

LayoutTests/editing/selection/move-node-in-selection-crash.html

Index: LayoutTests/editing/selection/move-node-in-selection-crash.html
diff --git a/LayoutTests/editing/selection/move-node-in-selection-crash.html b/LayoutTests/editing/selection/move-node-in-selection-crash.html
new file mode 100644
index 0000000000000000000000000000000000000000..6cbdc8f583318498613706c4b60d3fed4c658540
--- /dev/null
+++ b/LayoutTests/editing/selection/move-node-in-selection-crash.html
@@ -0,0 +1,29 @@
+<style>
+p { position: fixed; height: 1px; }
+hgroup { position: fixed; padding-bottom: 1px; padding-left: 100%; -webkit-column-span: all; }
+sup { display: -webkit-box; }
+</style>
+<script>
+if (window.testRunner)
+  testRunner.dumpAsText();
+
+window.onload = function() {
+  document.documentElement.appendChild(document.createElement('span'));
+  var grandparent = document.createElement('p');
+  document.documentElement.appendChild(grandparent);
+  document.execCommand('SelectAll', '');
+
+  grandparent.appendChild(document.createElement('hgroup'));
+  var oldParent = document.createElement('span');
+  grandparent.appendChild(oldParent);
+  var childToMove = document.createElement('sup');
+  oldParent.appendChild(childToMove);
+
+  document.body.offsetHeight;
+
+  // Move childToMove under the orphaned parent.
+  var orphanedParent = document.createElement('div');
+  orphanedParent.appendChild(childToMove);
+};
+</script>
+This is modified from a cluster-fuzz test case. Passes if no crash.