Ensure valid input for CompositeEditCommand::moveParagraph[s]

third_party/WebKit/Source/core/editing/commands/InsertListCommand.cpp

Index: third_party/WebKit/Source/core/editing/commands/InsertListCommand.cpp
diff --git a/third_party/WebKit/Source/core/editing/commands/InsertListCommand.cpp b/third_party/WebKit/Source/core/editing/commands/InsertListCommand.cpp
index 039777856d1be5fd214f58712ed40f8c55afe50e..50dd6e6d6fb0290912becc9a7c608c6182267158 100644
--- a/third_party/WebKit/Source/core/editing/commands/InsertListCommand.cpp
+++ b/third_party/WebKit/Source/core/editing/commands/InsertListCommand.cpp
@@ -431,6 +431,11 @@ void InsertListCommand::unlistifyParagraph(const VisiblePosition& originalStart,
         previousPositionOf(start).deepEquivalent().anchorNode(), listElement);
     DCHECK_NE(previousListChild, listChildNode);
   }
+
+  // Helpers for making |start| and |end| valid again after DOM changes.
+  PositionWithAffinity startPosition = start.toPositionWithAffinity();
+  PositionWithAffinity endPosition = end.toPositionWithAffinity();
+
   // When removing a list, we must always create a placeholder to act as a point
   // of insertion for the list content being removed.
   HTMLBRElement* placeholder = HTMLBRElement::create(document());
@@ -471,6 +476,12 @@ void InsertListCommand::unlistifyParagraph(const VisiblePosition& originalStart,
   if (editingState->isAborted())
     return;
 
+  document().updateStyleAndLayoutIgnorePendingStylesheets();
+
+  // Make |start| and |end| valid again.
+  start = createVisiblePosition(startPosition);
+  end = createVisiblePosition(endPosition);
+
   VisiblePosition insertionPoint = VisiblePosition::beforeNode(placeholder);
   moveParagraphs(start, end, insertionPoint, editingState, PreserveSelection,
                  PreserveStyle, listChildNode);