Reviewed by darin

        <rdar://problem/4920488>
        REGRESSION: A crash occurs at WebCore::Range::processContents () when removing formatting from selected text (that contains a link)

        * editing/execCommand/4920488-expected.checksum: Added.
        * editing/execCommand/4920488-expected.png: Added.
        * editing/execCommand/4920488-expected.txt: Added.
        * editing/execCommand/4920488.html: Added.
        * fast/dom/Range/compareBoundaryPoints-1-expected.txt: Added.
        * fast/dom/Range/compareBoundaryPoints-1.html: Added.

WebCore:

        Reviewed by darin
        
        <rdar://problem/4920488>
        REGRESSION: A crash occurs at WebCore::Range::processContents () when removing formatting from selected text (that contains a link)

        * dom/Range.cpp:
        (WebCore::Range::commonAncestorContainer): Return null if the nodes
        don't have a common ancestor.  As a side effect, the public 
        commonAncestorContainer now sets an exception if the Range starts
        in one document and ends in another, or starts or ends in a tree
        that's been removed from the document.  The spec doesn't cover
        this and there is no precedent in other browsers for this case because
        they don't allow invalid Ranges (you can create one with WebCore
        by removing a node that contains the start/end of a Range).
        (WebCore::Range::compareBoundaryPoints): If the the two positions
        are in nodes that have no common ancestor, return null.  This doesn't
        change the behavior of the public compareBoundaryPoints: it already
        throws an exception if the two positions are in nodes that don't have
        a common ancestor.  This follows the spec.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@18924 268f45cc-cd09-0410-ab3c-d52691b4dbfc