[Editing] Make loop condition in insertOrderedList::doApply strict.

Source/core/editing/commands/InsertListCommand.cpp

 /*
  * Copyright (C) 2006, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 88 matching lines @@
     }
 
     return true;
 }
 
 InsertListCommand::InsertListCommand(Document& document, Type type)
     : CompositeEditCommand(document), m_type(type)
 {
 }
 
+static bool inSameTreeAndOrdered(const VisiblePosition& shouldBeFormer, const VisiblePosition& shouldBeLater)
+{
+    const Position formerPosition = shouldBeFormer.deepEquivalent();
+    const Position laterPosition = shouldBeLater.deepEquivalent();
+    return Position::commonAncestorTreeScope(formerPosition, laterPosition) && comparePositions(formerPosition, laterPosition) <= 0;
+}
+
 void InsertListCommand::doApply()
 {
     if (!endingSelection().isNonOrphanedCaretOrRange())
         return;
 
     if (!endingSelection().rootEditableElement())
         return;
 
     VisiblePosition visibleEnd = endingSelection().visibleEnd();
     VisiblePosition visibleStart = endingSelection().visibleStart();
@@ skipping 27 matching lines @@
         // indexForVisiblePosition walks from the beginning of the document to the
         // endOfSelection everytime this code is executed. But not using index is hard
         // because there are so many ways we can los eselection inside doApplyForSingleParagraph.
         int indexForStartOfSelection = indexForVisiblePosition(startOfSelection, scopeForStartOfSelection);
         int indexForEndOfSelection = indexForVisiblePosition(endOfSelection, scopeForEndOfSelection);
 
         if (startOfParagraph(startOfSelection, CanSkipOverEditingBoundary).deepEquivalent() != startOfLastParagraph.deepEquivalent()) {
             forceListCreation = !selectionHasListOfType(selection, listTag);
 
             VisiblePosition startOfCurrentParagraph = startOfSelection;
-            while (startOfCurrentParagraph.isNotNull() && !inSameParagraph(startOfCurrentParagraph, startOfLastParagraph, CanCrossEditingBoundary)) {
+            while (inSameTreeAndOrdered(startOfCurrentParagraph, startOfLastParagraph) && !inSameParagraph(startOfCurrentParagraph, startOfLastParagraph, CanCrossEditingBoundary)) {
                 // doApply() may operate on and remove the last paragraph of the selection from the document
                 // if it's in the same list item as startOfCurrentParagraph.  Return early to avoid an
                 // infinite loop and because there is no more work to be done.
                 // FIXME(<rdar://problem/5983974>): The endingSelection() may be incorrect here.  Compute
                 // the new location of endOfSelection and use it as the end of the new selection.
                 if (!startOfLastParagraph.deepEquivalent().inDocument())
                     return;
                 setEndingSelection(startOfCurrentParagraph);
 
                 // Save and restore endOfSelection and startOfLastParagraph when necessary
@@ skipping 253 matching lines @@
     return listElement;
 }
 
 DEFINE_TRACE(InsertListCommand)
 {
     visitor->trace(m_listElement);
     CompositeEditCommand::trace(visitor);
 }
 
 }