Check the traversal state in CompositeEditCommand::cloneParagraphUnderNewElement

Source/core/editing/CompositeEditCommand.cpp

Index: Source/core/editing/CompositeEditCommand.cpp
diff --git a/Source/core/editing/CompositeEditCommand.cpp b/Source/core/editing/CompositeEditCommand.cpp
index 2bc0ec0fd77fad0f36644ae02fe200f757b0d1f8..c40ac10c613ad416c5ab3d896b04862c01d1a818 100644
--- a/Source/core/editing/CompositeEditCommand.cpp
+++ b/Source/core/editing/CompositeEditCommand.cpp
@@ -965,6 +965,8 @@ void CompositeEditCommand::pushAnchorElementDown(Node* anchorNode)
 void CompositeEditCommand::cloneParagraphUnderNewElement(const Position& start, const Position& end, Node* passedOuterNode, Element* blockElement)
 {
     ASSERT(comparePositions(start, end) <= 0);
+    ASSERT(passedOuterNode);
+    ASSERT(blockElement);
 
     // First we clone the outerNode
     RefPtr<Node> lastNode;
@@ -1006,20 +1008,26 @@ void CompositeEditCommand::cloneParagraphUnderNewElement(const Position& start,
         // If end is not a descendant of outerNode we need to
         // find the first common ancestor to increase the scope
         // of our nextSibling traversal.
-        while (!end.deprecatedNode()->isDescendantOf(outerNode.get())) {
+        while (outerNode && !end.deprecatedNode()->isDescendantOf(outerNode.get())) {
             outerNode = outerNode->parentNode();
         }
 
+        if (!outerNode)
+            return;
+
         RefPtr<Node> startNode = start.deprecatedNode();
         for (RefPtr<Node> node = NodeTraversal::nextSkippingChildren(*startNode, outerNode.get()); node; node = NodeTraversal::nextSkippingChildren(*node, outerNode.get())) {
             // Move lastNode up in the tree as much as node was moved up in the
             // tree by NodeTraversal::nextSkippingChildren, so that the relative depth between
             // node and the original start node is maintained in the clone.
-            while (startNode->parentNode() != node->parentNode()) {
+            while (startNode && lastNode && startNode->parentNode() != node->parentNode()) {
                 startNode = startNode->parentNode();
                 lastNode = lastNode->parentNode();
             }
 
+            if (!lastNode || !lastNode->parentNode())
+                return;
+
             RefPtr<Node> clonedNode = node->cloneNode(true);
             insertNodeAfter(clonedNode, lastNode);
             lastNode = clonedNode.release();