[Editing][BugFix] Fix if condition in ReplaceSelectionCommand

third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommand.cpp

 /*
  * Copyright (C) 2005, 2006, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2009, 2010, 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 995 matching lines @@
         insertionPos = endingSelection().start();
     }
 
     // We don't want any of the pasted content to end up nested in a Mail blockquote, so first break
     // out of any surrounding Mail blockquotes. Unless we're inserting in a table, in which case
     // breaking the blockquote will prevent the content from actually being inserted in the table.
     if (startIsInsideMailBlockquote && m_preventNesting && !(enclosingNodeOfType(insertionPos, &isTableStructureNode))) {
         applyCommandToComposite(BreakBlockquoteCommand::create(document()));
         // This will leave a br between the split.
         Node* br = endingSelection().start().anchorNode();
-        ASSERT(isHTMLBRElement(br));
-        // Insert content between the two blockquotes, but remove the br (since it was just a placeholder).
-        insertionPos = positionInParentBeforeNode(*br);
-        removeNode(br);
+        if (isHTMLBRElement(br)) {
+            // Insert content between the two blockquotes, but remove the br (since it was just a placeholder).
+            insertionPos = positionInParentBeforeNode(*br);
+            removeNode(br);
+        }
     }
 
     // Inserting content could cause whitespace to collapse, e.g. inserting <div>foo</div> into hello^ world.
     prepareWhitespaceAtPositionForSplit(insertionPos);
 
     // If the downstream node has been removed there's no point in continuing.
     if (!mostForwardCaretPosition(insertionPos).anchorNode())
         return;
 
     // NOTE: This would be an incorrect usage of downstream() if downstream() were changed to mean the last position after
@@ skipping 519 matching lines @@
 DEFINE_TRACE(ReplaceSelectionCommand)
 {
     visitor->trace(m_startOfInsertedContent);
     visitor->trace(m_endOfInsertedContent);
     visitor->trace(m_insertionStyle);
     visitor->trace(m_documentFragment);
     CompositeEditCommand::trace(visitor);
 }
 
 } // namespace blink