Same fix as the one I did for toString() yesterday: a 0 end offset means we don't have to dive into the end container at all. This time I used WebCore r7649 to fix it as it also brings some sanity checks for offset overflows.
Changed paths: