When splitText is called on a Text node, we fail to update Ranges whose boundary points' container nodes are the parent node of the Text node.
Since splitText can insert a new node, we should be updating Ranges.
Created attachment 269261 [details]
Fixes the bug
Committed r195281: <http://trac.webkit.org/changeset/195281>