Bug fix: toPositionInCoposedTree should treat positions with insertion points

Source/core/dom/Position.cpp

Index: Source/core/dom/Position.cpp
diff --git a/Source/core/dom/Position.cpp b/Source/core/dom/Position.cpp
index 851407716b77748218f4557be5b50b7315d7e118..47dd2ba12d41d1d0847a05be9004b4e8acc3a4ad 100644
--- a/Source/core/dom/Position.cpp
+++ b/Source/core/dom/Position.cpp
@@ -1408,10 +1408,14 @@ PositionInComposedTree toPositionInComposedTree(const Position& pos)
         Node* anchor = pos.anchorNode();
         if (anchor->offsetInCharacters())
             return PositionInComposedTree(anchor, pos.computeOffsetInContainerNode(), PositionInComposedTree::PositionIsOffsetInAnchor);
-        Node* child = NodeTraversal::childAt(*anchor, pos.computeOffsetInContainerNode());
+        ASSERT(!isActiveInsertionPoint(*anchor));
+        int offset = pos.computeOffsetInContainerNode();
+        Node* child = NodeTraversal::childAt(*anchor, offset);
         if (!child)
             return PositionInComposedTree(anchor, PositionInComposedTree::PositionIsAfterChildren);
         child->updateDistribution();
+        if (isActiveInsertionPoint(*child))
+            return PositionInComposedTree(anchor, offset, PositionInComposedTree::PositionIsOffsetInAnchor);
         return PositionInComposedTree(ComposedTreeTraversal::parent(*child), ComposedTreeTraversal::index(*child), PositionInComposedTree::PositionIsOffsetInAnchor);
     }