Crash with ranges across a detached, reparented node tree

Crash with ranges across a detached, reparented node tree
https://bugs.webkit.org/show_bug.cgi?id=72757

Reviewed by Adam Barth.

Source/WebCore:

Test: fast/dom/move-detached-child-in-range.html

* dom/RangeBoundaryPoint.h:
(WebCore::RangeBoundaryPoint::childBefore): protect the raw child node from getting pulled from under us.

LayoutTests:

* fast/dom/move-detached-child-in-range-expected.txt: Added.
* fast/dom/move-detached-child-in-range.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@100827 268f45cc-cd09-0410-ab3c-d52691b4dbfc