Reviewed by Darin.
        
        Fix for <rdar://problem/5433726>
        Mail crash at WebCore::Frame::styleForSelectionStart() when deleting a selection in a HTML message (http://www.yahoo.com/)

        Test: editing/style/temporary-span-crash.html

        * page/Frame.cpp:
        (WebCore::Frame::styleForSelectionStart):
        Temporary span created here might not have renderer if document has style sheet that makes it display:none.
        Set display:inline explicitly in spans style attribute. This temporary span does not need to get its display 
        value from actual document style sheets. Null check the renderer too to be sure.

LayoutTests:

        Reviewed by Darin.
        
        Test for <rdar://problem/5433726>
        Mail crash at WebCore::Frame::styleForSelectionStart() when deleting a selection in a HTML message (http://www.yahoo.com/)

        * editing/style/temporary-span-crash-expected.txt: Added.
        * editing/style/temporary-span-crash.html: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@25255 268f45cc-cd09-0410-ab3c-d52691b4dbfc