Don't come undone when undoing the editing of a Custom Element.

Source/core/dom/CustomElementRegistrationContext.cpp

Index: Source/core/dom/CustomElementRegistrationContext.cpp
diff --git a/Source/core/dom/CustomElementRegistrationContext.cpp b/Source/core/dom/CustomElementRegistrationContext.cpp
index 1a7ea72e7bbb8149c948e42eee62e3a902211159..1917c893abcdd2280cf9b863915a06f7ffb7d16a 100644
--- a/Source/core/dom/CustomElementRegistrationContext.cpp
+++ b/Source/core/dom/CustomElementRegistrationContext.cpp
@@ -163,8 +163,17 @@ void CustomElementRegistrationContext::setTypeExtension(Element* element, const
     if (!element->isHTMLElement() && !element->isSVGElement())
         return;
 
-    if (isCustomTagName(element->localName()))
-        return; // custom tags take precedence over type extensions
+    if (element->isCustomElement()) {
+        // This can happen if:
+        // 1. The element has a custom tag, which takes precedence over
+        //    type extensions.
+        // 2. Undoing a command (eg ReplaceNodeWithSpan) recycles an
+        //    element but tries to overwrite its attribute list.
+        return;
+    }
+
+    // Custom tags take precedence over type extensions
+    ASSERT(!isCustomTagName(element->localName()));
 
     if (CustomElementRegistrationContext* context = element->document()->registrationContext())
         context->didGiveTypeExtension(element, type);