Don't come undone when undoing the editing of a Custom Element.

Source/core/dom/CustomElementRegistrationContext.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 145 matching lines @@
     ASSERT(!type.isEmpty());
     element->setAttribute(HTMLNames::isAttr, type);
     setTypeExtension(element, type);
 }
 
 void CustomElementRegistrationContext::setTypeExtension(Element* element, const AtomicString& type)
 {
     if (!element->isHTMLElement() && !element->isSVGElement())
         return;
 
-    if (isCustomTagName(element->localName()))
-        return; // custom tags take precedence over type extensions
+    if (element->isCustomElement()) {
+        // This can happen if:
+        // 1. The element has a custom tag, which takes precedence over
+        //    type extensions.
+        // 2. Undoing a command (eg ReplaceNodeWithSpan) recycles an
+        //    element but tries to overwrite its attribute list.
+        return;
+    }
+
+    // Custom tags take precedence over type extensions
+    ASSERT(!isCustomTagName(element->localName()));
 
     if (CustomElementRegistrationContext* context = element->document()->registrationContext())
         context->didGiveTypeExtension(element, type);
 }
 
 } // namespace WebCore