[Editing][BugFix] Check editability in InserListCommand::listifyParagraph

third_party/WebKit/Source/core/editing/commands/InsertListCommand.cpp

 /*
  * Copyright (C) 2006, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 343 matching lines @@
 }
 
 void InsertListCommand::listifyParagraph(const VisiblePosition& originalStart, const HTMLQualifiedName& listTag)
 {
     const VisiblePosition& start = startOfParagraph(originalStart, CanSkipOverEditingBoundary);
     const VisiblePosition& end = endOfParagraph(start, CanSkipOverEditingBoundary);
 
     if (start.isNull() || end.isNull())
         return;
 
+    {
+        // The paragraph between |start| and |end| shoule be editable.
+        const Position& startPosition = start.toParentAnchoredPosition();
+        const Position& endPosition = end.toParentAnchoredPosition();
+        if (!isEditablePosition(startPosition) || !isEditablePosition(endPosition))
+            return;
+        Node* commonAncestor = NodeTraversal::commonAncestor(*startPosition.anchorNode(), *endPosition.anchorNode());
+        if (!commonAncestor || !commonAncestor->hasEditableStyle())
+            return;
+    }
+
     // Check for adjoining lists.
     HTMLElement* const previousList = adjacentEnclosingList(start, previousPositionOf(start, CannotCrossEditingBoundary), listTag);
     HTMLElement* const nextList = adjacentEnclosingList(start, nextPositionOf(end, CannotCrossEditingBoundary), listTag);
     if (previousList || nextList) {
         // Place list item into adjoining lists.
         const RefPtrWillBeRawPtr<HTMLLIElement> listItemElement = HTMLLIElement::create(document());
         if (previousList)
             appendNode(listItemElement, previousList);
         else
             insertNodeAt(listItemElement, Position::beforeNode(nextList));
@@ skipping 57 matching lines @@
     const VisiblePosition& end = endOfParagraph(pos, CanSkipOverEditingBoundary);
     moveParagraph(start, end, createVisiblePosition(positionBeforeNode(placeholder.get())), true);
 }
 
 DEFINE_TRACE(InsertListCommand)
 {
     CompositeEditCommand::trace(visitor);
 }
 
 } // namespace blink