Splitting text can leave |start| and |end| Positions without renderers

LayoutTests/editing/apply-inline-style-to-element-with-no-renderer-crash.html

+<script>
+// crbug.com/339185: If we create an anchor element using execCommand('CreateLink') in an SVG namespace it won't get a renderer because the command will create
+// an HTML rather than an SVG anchor. Our subsequent attempt to apply an inline style on the should fail rather than result in a crash.
+onload = function() {
+    tspan = document.getElementById("tspan");
+    tspan2 = document.getElementById("tspan2");
+    textPath = document.getElementById("textPath");
+
+    colorprofile = document.createElementNS('http://www.w3.org/2000/svg', 'color_profile');
+    li = document.createElement('li');
+    colorprofile.appendChild(li);
+    document.implementation.createDocument('' ,'' ,null).adoptNode(colorprofile)
+
+    input=document.createElement('input');
+    textPath.parentNode.insertBefore(input, textPath);
+    window.getSelection().setBaseAndExtent(input, 4);
+
+    document.designMode='on';
+    document.execCommand('Transpose');
+    document.execCommand('selectall');
+    document.execCommand('CreateLink', 0, '#');
+    document.execCommand('CreateLink', 0, '#');
+    document.execCommand('Undo');
+    document.designMode='off'
+    document.execCommand('Undo');
+    document.execCommand('Undo');
+    document.designMode='on';
+    document.execCommand('italic');
+}
+</script>
+<svg>
+    <text>
+        <tspan id="tspan">
+            <tspan id="tspan2">%uef5f%u9776%u638a</tspan>
+            <textPath id="textPath"></textPath>
+        </tspan>
+    </text>
+</svg>