[Editing][BugFix] Check editability in InserListCommand::listifyParagraph

third_party/WebKit/Source/core/editing/commands/InsertListCommand.cpp

Index: third_party/WebKit/Source/core/editing/commands/InsertListCommand.cpp
diff --git a/third_party/WebKit/Source/core/editing/commands/InsertListCommand.cpp b/third_party/WebKit/Source/core/editing/commands/InsertListCommand.cpp
index bfac9e0f9ea424c73d92e3bccdd2459a5c2833d5..1b46887f885e0e57749944304bc34741c70692e2 100644
--- a/third_party/WebKit/Source/core/editing/commands/InsertListCommand.cpp
+++ b/third_party/WebKit/Source/core/editing/commands/InsertListCommand.cpp
@@ -361,6 +361,17 @@ void InsertListCommand::listifyParagraph(const VisiblePosition& originalStart, c
     if (start.isNull() || end.isNull())
         return;
 
+    {
+        // The paragraph between |start| and |end| shoule be editable.
+        const Position& startPosition = start.toParentAnchoredPosition();
+        const Position& endPosition = end.toParentAnchoredPosition();
+        if (!isEditablePosition(startPosition) || !isEditablePosition(endPosition))
+            return;
+        Node* commonAncestor = NodeTraversal::commonAncestor(*startPosition.anchorNode(), *endPosition.anchorNode());
+        if (!commonAncestor || !commonAncestor->hasEditableStyle())
+            return;
+    }
+
     // Check for adjoining lists.
     HTMLElement* const previousList = adjacentEnclosingList(start, previousPositionOf(start, CannotCrossEditingBoundary), listTag);
     HTMLElement* const nextList = adjacentEnclosingList(start, nextPositionOf(end, CannotCrossEditingBoundary), listTag);