[Editing] Make InsertListCommand check endingSelection() editability.

Source/core/editing/InsertListCommand.cpp

 /*
  * Copyright (C) 2006, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 154 matching lines @@
 
                 // Save and restore endOfSelection and startOfLastParagraph when necessary
                 // since moveParagraph and movePragraphWithClones can remove nodes.
                 if (!doApplyForSingleParagraph(forceListCreation, listTag, *currentSelection))
                     break;
                 if (endOfSelection.isNull() || endOfSelection.isOrphan() || startOfLastParagraph.isNull() || startOfLastParagraph.isOrphan()) {
                     endOfSelection = visiblePositionForIndex(indexForEndOfSelection, scopeForEndOfSelection.get());
                     // If endOfSelection is null, then some contents have been deleted from the document.
                     // This should never happen and if it did, exit early immediately because we've lost the loop invariant.
                     ASSERT(endOfSelection.isNotNull());
-                    if (endOfSelection.isNull())
+                    if (endOfSelection.isNull() || !endOfSelection.rootEditableElement())
                         return;
                     startOfLastParagraph = startOfParagraph(endOfSelection, CanSkipOverEditingBoundary);
                 }
 
                 startOfCurrentParagraph = startOfNextParagraph(endingSelection().visibleStart());
             }
             setEndingSelection(endOfSelection);
         }
         doApplyForSingleParagraph(forceListCreation, listTag, *currentSelection);
         // Fetch the end of the selection, for the reason mentioned above.
@@ skipping 231 matching lines @@
     return listElement;
 }
 
 DEFINE_TRACE(InsertListCommand)
 {
     visitor->trace(m_listElement);
     CompositeEditCommand::trace(visitor);
 }
 
 }