Fix an assertion failure in HTMLTextAreaElement::subtreeHasChanged.

third_party/WebKit/Source/core/editing/commands/InsertLineBreakCommand.cpp

Index: third_party/WebKit/Source/core/editing/commands/InsertLineBreakCommand.cpp
diff --git a/third_party/WebKit/Source/core/editing/commands/InsertLineBreakCommand.cpp b/third_party/WebKit/Source/core/editing/commands/InsertLineBreakCommand.cpp
index ccd2ef56ce0b0e5dbc30425c025cc2db4bd6a0d7..f125ac00380230540fb8c300d28d02d8432f703f 100644
--- a/third_party/WebKit/Source/core/editing/commands/InsertLineBreakCommand.cpp
+++ b/third_party/WebKit/Source/core/editing/commands/InsertLineBreakCommand.cpp
@@ -105,11 +105,15 @@ void InsertLineBreakCommand::doApply(EditingState* editingState)
         if (needExtraLineBreak) {
             Node* extraNode;
             // TODO(tkent): Can we remove HTMLTextFormControlElement dependency?
-            if (HTMLTextFormControlElement* textControl = enclosingTextFormControl(nodeToInsert))
+            if (HTMLTextFormControlElement* textControl = enclosingTextFormControl(nodeToInsert)) {
                 extraNode = textControl->createPlaceholderBreakElement();
-            else
+                // The placeholder BR should be the last child.  There might be
+                // empty Text nodes at |pos|.
+                appendNode(extraNode, nodeToInsert->parentNode(), editingState);
+            } else {
                 extraNode = nodeToInsert->cloneNode(false);
-            insertNodeAfter(extraNode, nodeToInsert, editingState);
+                insertNodeAfter(extraNode, nodeToInsert, editingState);
+            }
             if (editingState->isAborted())
                 return;
             nodeToInsert = extraNode;