Fixing crash in doApplyForSingleParagraph().

Source/core/editing/InsertListCommand.cpp

 /*
  * Copyright (C) 2006, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 203 matching lines @@
 
         // If the entire list is selected, then convert the whole list.
         if (switchListType && isNodeVisiblyContainedWithin(listNode.get(), currentSelection)) {
             bool rangeStartIsInList = visiblePositionBeforeNode(listNode.get()) == VisiblePosition(currentSelection->startPosition());
             bool rangeEndIsInList = visiblePositionAfterNode(listNode.get()) == VisiblePosition(currentSelection->endPosition());
 
             RefPtr<HTMLElement> newList = createHTMLElement(document(), listTag);
             insertNodeBefore(newList, listNode);
 
             Node* firstChildInList = enclosingListChild(VisiblePosition(firstPositionInNode(listNode.get())).deepEquivalent().deprecatedNode(), listNode.get());
-            Node* outerBlock = firstChildInList->isBlockFlowElement() ? firstChildInList : listNode.get();
+            Node* outerBlock = firstChildInList ? (firstChildInList->isBlockFlowElement() ? firstChildInList : listNode.get()) : listNode.get();

[Yuta Kitamura, 2014/02/27 01:59:14]

This can be simplified as:
    firstChildInList && firstChildInList->isBlockFlowElement() ?
firstChildInList : listNode.get()

[arpitab_, 2014/02/27 05:10:07]

Done.

 
             moveParagraphWithClones(VisiblePosition(firstPositionInNode(listNode.get())), VisiblePosition(lastPositionInNode(listNode.get())), newList.get(), outerBlock);
 
             // Manually remove listNode because moveParagraphWithClones sometimes leaves it behind in the document.
             // See the bug 33668 and editing/execCommand/insert-list-orphaned-item-with-nested-lists.html.
             // FIXME: This might be a bug in moveParagraphWithClones or deleteSelection.
             if (listNode && listNode->inDocument())
                 removeNode(listNode);
 
             newList = mergeWithNeighboringLists(newList);
@@ skipping 156 matching lines @@
     if (listElement)
         return mergeWithNeighboringLists(listElement);
 
     if (canMergeLists(previousList, nextList))
         mergeIdenticalElements(previousList, nextList);
 
     return listElement;
 }
 
 }