Splitting text can leave |start| and |end| Positions without renderers

LayoutTests/editing/apply-inline-style-to-element-with-no-renderer-crash.html

Index: LayoutTests/editing/apply-inline-style-to-element-with-no-renderer-crash.html
diff --git a/LayoutTests/editing/apply-inline-style-to-element-with-no-renderer-crash.html b/LayoutTests/editing/apply-inline-style-to-element-with-no-renderer-crash.html
new file mode 100644
index 0000000000000000000000000000000000000000..f080c1b52097ed001ea7c7030ad7188e340d7199
--- /dev/null
+++ b/LayoutTests/editing/apply-inline-style-to-element-with-no-renderer-crash.html
@@ -0,0 +1,50 @@
+<script>

[yosin_UTC9, 2014/10/15 01:26:41]

Could you simplify this test case?
We can have static SVG document then apply "createLink" and "italic".

[rhogan, 2014/10/15 20:20:30]

I've reduced it down to a more manageable size.

+// crbug.com/339185: If we create an anchor element using execCommand('CreateLink') in an SVG namespace it won't get a renderer because the command will create 
+// an HTML rather than an SVG anchor. Our subsequent attempt to apply an inline style on the should fail rather than result in a crash.
+onload = function() {
+var xs=[
+"el0=document.createElementNS('http://www.w3.org/2000/svg', 'svg'); document.body.appendChild(el0); ",
+ "el1=document.createElementNS('http://www.w3.org/2000/svg', 'svg'); ",
+ "el2=document.createElementNS('http://www.w3.org/2000/svg', 'text'); el0.appendChild(el2); ",
+ "el3=document.createElementNS('http://www.w3.org/2000/svg', 'font'); ",
+ "el4=document.createElementNS('http://www.w3.org/2000/svg', 'switch'); ",
+ "el6=document.createElement('ruby'); if(!el4.parentNode) { document.body.appendChild(el4) }; el4.parentNode.insertBefore(el6, el4); ",
+ "el7=document.createElementNS('http://www.w3.org/2000/svg', 'tspan'); el2.appendChild(el7); ",
+ "el9=document.createElementNS('http://www.w3.org/2000/svg', 'tspan'); el7.appendChild(el9); ",
+ "el10=document.createElementNS('http://www.w3.org/2000/svg', 'circle'); ",
+ "el11=document.createElementNS('http://www.w3.org/2000/svg', 'circle'); el11.setAttribute('ry', '186em'); ",
+ "el12=document.createElementNS('http://www.w3.org/2000/svg', 'polygon'); ",
+ "el9.appendChild(document.createTextNode(unescape('%uef5f%u9776%u638a'))); ",
+ "el13=document.createElementNS('http://www.w3.org/2000/svg', 'desc'); ",
+ "el14=document.createElementNS('http://www.w3.org/2000/svg', 'textPath'); el7.appendChild(el14); ",
+ "el15=document.createElementNS('http://www.w3.org/2000/svg', 'missing_glyph'); ",
+ "el17=document.createElementNS('http://www.w3.org/2000/svg', 'polyline'); ",
+ "el18=document.createElementNS('http://www.w3.org/2000/svg', 'altGlyphDef'); ",
+ "el19=document.createElementNS('http://www.w3.org/2000/svg', 'animateMotion'); ",
+ "el22=document.createElementNS('http://www.w3.org/2000/svg', 'use'); ",
+ "el23=document.createElementNS('http://www.w3.org/2000/svg', 'color_profile'); ",
+ "el24=document.createElement('li'); el23.appendChild(el24); ",
+ "el25=document.createElementNS('http://www.w3.org/2000/svg', 'line'); ",
+ "el26=document.createElementNS('http://www.w3.org/2000/svg', 'glyph'); ",
+ "el27=document.createElementNS('http://www.w3.org/2000/svg', 'symbol'); ",
+ "el28=document.createElementNS('http://www.w3.org/2000/svg', 'altGlyphDef'); ",
+ "el30=document.createElementNS('http://www.w3.org/2000/svg', 'filter'); el30.setAttribute('enable-background', '93');",
+ "el31=document.createElement('meter'); ",
+ "el50=document.createElement('rp'); ",
+ "el52=document.createElement('input'); el14.parentNode.insertBefore(el52, el14); ",
+ "document.designMode='on'; ",
+ "el60=document.createElement('style'); ",
+ "el64=document.createElementNS('http://www.w3.org/2000/svg', 'feBlend'); el64.setAttribute('mode', 'lighten'); ",
+ "document.designMode='on'; window.getSelection().setBaseAndExtent(el52, 4); document.execCommand('Transpose'); document.designMode='off'",
+ "el66=document.createElement('input'); ",
+ "document.implementation.createDocument('' ,'' ,null).adoptNode(el23)",
+ "document.designMode='on'; window.getSelection().setBaseAndExtent(el25, 0, el14, 4); document.execCommand('InsertNewlineInQuotedContent'); document.execCommand('selectall'); document.execCommand('insertText', 'LOL'); document.execCommand('Undo'); document.execCommand('CreateLink', 0, '#'); document.designMode='off'",
+ "document.designMode='on'; document.execCommand('CreateLink', 0, '#'); document.execCommand('FormatBlock', ''); document.execCommand('Undo'); document.designMode='off'",
+ "document.execCommand('FormatBlock', ''); document.execCommand('Undo');",
+ "document.execCommand('FormatBlock', ''); document.execCommand('Undo'); document.execCommand('insertText', 'LOL'); document.execCommand('Undo'); document.designMode='off'",
+ "document.designMode='on'; window.getSelection().setBaseAndExtent(el24, 3); document.execCommand('italic'); document.designMode='off'",
+];
+function next0() { for(var i=0; i<15; i++) { var xy=xs.shift(); eval(xy); }; setTimeout(next0,0) }
+setTimeout(next0,0)
+}
+</script>