Merge 73052 - 2010-12-01 Ryosuke Niwa <rniwa@webkit.org>...

WebCore/ChangeLog

Index: WebCore/ChangeLog
===================================================================
--- WebCore/ChangeLog	(revision 73077)
+++ WebCore/ChangeLog	(working copy)
@@ -1,3 +1,26 @@
+2010-12-01  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler, Tony Chang, and unofficially by Enrica Casucci.
+
+        chrome.dll!WebCore::RangeBoundaryPoint::toPosition ReadAV@NULL (cf0d0f28bc56f2591cc74f71b46036ea)
+        https://bugs.webkit.org/show_bug.cgi?id=47808
+
+        The crash was caused by moveParagraphWithClones' not copying the entire paragraph
+        when called by doApplyForSingleParagraph, which was induced by a bug in
+        cloneParagraphUnderNewElement which ended the cloning process early when the start node
+        and the end node didn't share the same parent node. Fixed the bug in cloneParagraphUnderNewElement
+        by calling traverseNextSibling(outerNode) instead of nextSibling().
+
+        Also added an early exit to InsertListCommand::doApply when lastSelectionRange is null.
+
+        Tests: editing/execCommand/switch-multiple-list-items-crash.html
+               editing/execCommand/switch-multiple-list-items.html
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement):
+        * editing/InsertListCommand.cpp:
+        (WebCore::InsertListCommand::doApply):
+
 2010-11-29  Ilya Sherman  <isherman@chromium.org>
 
         Reviewed by Kent Tamura.