Fix an assertion failure in HTMLTextAreaElement::subtreeHasChanged.

third_party/WebKit/Source/core/editing/commands/InsertLineBreakCommand.cpp

 /*
  * Copyright (C) 2005, 2006 Apple Computer, Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 87 matching lines @@
     if (isEndOfParagraph(caret) && !lineBreakExistsAtVisiblePosition(caret)) {
         bool needExtraLineBreak = !isHTMLHRElement(*pos.anchorNode()) && !isHTMLTableElement(*pos.anchorNode());
 
         insertNodeAt(nodeToInsert, pos, editingState);
         if (editingState->isAborted())
             return;
 
         if (needExtraLineBreak) {
             Node* extraNode;
             // TODO(tkent): Can we remove HTMLTextFormControlElement dependency?
-            if (HTMLTextFormControlElement* textControl = enclosingTextFormControl(nodeToInsert))
+            if (HTMLTextFormControlElement* textControl = enclosingTextFormControl(nodeToInsert)) {
                 extraNode = textControl->createPlaceholderBreakElement();
-            else
+                // The placeholder BR should be the last child.  There might be
+                // empty Text nodes at |pos|.
+                appendNode(extraNode, nodeToInsert->parentNode(), editingState);
+            } else {
                 extraNode = nodeToInsert->cloneNode(false);
-            insertNodeAfter(extraNode, nodeToInsert, editingState);
+                insertNodeAfter(extraNode, nodeToInsert, editingState);
+            }
             if (editingState->isAborted())
                 return;
             nodeToInsert = extraNode;
         }
 
         VisiblePosition endingPosition = VisiblePosition::beforeNode(nodeToInsert);
         setEndingSelection(VisibleSelection(endingPosition, endingSelection().isDirectional()));
     } else if (pos.computeEditingOffset() <= caretMinOffset(pos.anchorNode())) {
         insertNodeAt(nodeToInsert, pos, editingState);
         if (editingState->isAborted())
@@ skipping 65 matching lines @@
         // before the line break (if the line break is at the end of a block it isn't selectable).
         // So, this next call sets the endingSelection() to a caret just after the line break
         // that we inserted, or just before it if it's at the end of a block.
         setEndingSelection(endingSelection().visibleEnd());
     }
 
     rebalanceWhitespace();
 }
 
 } // namespace blink