Crash in WebCore::InsertTextCommand::positionInsideTextNode

Crash in WebCore::InsertTextCommand::positionInsideTextNode
https://bugs.webkit.org/show_bug.cgi?id=240480

Reviewed by Ryosuke Niwa.

Calling pushAnchorElementDown in CompositeEditCommand::positionAvoidingSpecialElementBoundary can
end up removing the startPosition's container node which leaves an invalid endingSelection.

InsertTextCommand::doApply requires a real endingSelection, so we should check if this occurred and bail out.

* editing/InsertTextCommand.cpp:
(WebCore::InsertTextCommand::doApply):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@294281 268f45cc-cd09-0410-ab3c-d52691b4dbfc