Abort CompositeEditCommand::moveParagraphs if destination is inside moving range

third_party/WebKit/Source/core/editing/commands/CompositeEditCommand.cpp

Index: third_party/WebKit/Source/core/editing/commands/CompositeEditCommand.cpp
diff --git a/third_party/WebKit/Source/core/editing/commands/CompositeEditCommand.cpp b/third_party/WebKit/Source/core/editing/commands/CompositeEditCommand.cpp
index ebbb4448045ba7e261463ccc4d95b5974397afbc..29a17ac75d586f4724334baaaa8010122d4aa1ac 100644
--- a/third_party/WebKit/Source/core/editing/commands/CompositeEditCommand.cpp
+++ b/third_party/WebKit/Source/core/editing/commands/CompositeEditCommand.cpp
@@ -1511,6 +1511,14 @@ void CompositeEditCommand::moveParagraphs(
       startOfParagraphToMove.isNull())
     return;
 
+  // Can't move the range to a destination inside itself.
+  if (destination.deepEquivalent() > startOfParagraphToMove.deepEquivalent() &&
+      destination.deepEquivalent() < endOfParagraphToMove.deepEquivalent()) {
+    // Reached by unit test TypingCommandTest.insertLineBreakWithIllFormedHTML
+    editingState->abort();
+    return;
+  }
+
   int startIndex = -1;
   int endIndex = -1;
   int destinationIndex = -1;