Splitting text can leave |start| and |end| Positions without renderers

Source/core/editing/ApplyStyleCommand.cpp

Index: Source/core/editing/ApplyStyleCommand.cpp
diff --git a/Source/core/editing/ApplyStyleCommand.cpp b/Source/core/editing/ApplyStyleCommand.cpp
index d85ecf489f3bbf09b591dfc237b91521935a775f..6e9bdf1523b7a2ce510ad339078aad8be8ce0fce 100644
--- a/Source/core/editing/ApplyStyleCommand.cpp
+++ b/Source/core/editing/ApplyStyleCommand.cpp
@@ -583,6 +583,8 @@ void ApplyStyleCommand::applyInlineStyle(EditingStyle* style)
             splitTextAtStart(start, end);
         start = startPosition();
         end = endPosition();
+        if (start.isNull() || end.isNull())
+            return;
         startDummySpanAncestor = dummySpanAncestorForNode(start.deprecatedNode());
     }
 
@@ -595,6 +597,8 @@ void ApplyStyleCommand::applyInlineStyle(EditingStyle* style)
             splitTextAtEnd(start, end);
         start = startPosition();
         end = endPosition();
+        if (start.isNull() || end.isNull())
+            return;
         endDummySpanAncestor = dummySpanAncestorForNode(end.deprecatedNode());
     }
 
@@ -1265,6 +1269,8 @@ bool ApplyStyleCommand::shouldSplitTextElement(Element* element, EditingStyle* s
 
 bool ApplyStyleCommand::isValidCaretPositionInTextNode(const Position& position)
 {
+    ASSERT(position.isNotNull());
+
     Node* node = position.containerNode();
     if (position.anchorType() != Position::PositionIsOffsetInAnchor || !node->isTextNode())
         return false;