https://bugs.webkit.org/show_bug.cgi?id=20471
<rdar://problem/7783629>
        
Reviewed by Adele Peterson.

This fixes the crash but also fixes the generated markup when
performing a replacement at the border with an inline, to avoid the 
new content being merged into the inline.
The crash is happening when doApply detects the need of merging
the start and the end of the new paragraph and the destination position
is moved inside an inline.
        
I've added new test cases to an existing layout test.
        
* editing/ReplaceSelectionCommand.cpp:
(WebCore::ReplaceSelectionCommand::doApply): When the situation described above is detected,
we insert a placeholder to avoid merging into the inline.

LayoutTests: Crash when dragging text in Google Docs
https://bugs.webkit.org/show_bug.cgi?id=20471
<rdar://problem/7783629>

Reviewed by Adele Peterson.

Added new test cases to an exisisting file and updated the result to reflect
the correct behavior.
        
* editing/selection/replace-selection-crash-expected.txt:
* editing/selection/replace-selection-crash.html:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@66344 268f45cc-cd09-0410-ab3c-d52691b4dbfc