Don't refer to removed spans when reformulating pasted content.

third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommandTest.cpp

Index: third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommandTest.cpp
diff --git a/third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommandTest.cpp b/third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommandTest.cpp
index f833401c1652bc7e4a9a2dbfd65307e76c35e7ca..3624499beb95d8747140ae69d0efd909d5174165 100644
--- a/third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommandTest.cpp
+++ b/third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommandTest.cpp
@@ -51,6 +51,30 @@ TEST_F(ReplaceSelectionCommandTest, pastingEmptySpan) {
   EXPECT_EQ("foo", document().body()->innerHTML()) << "no DOM tree mutation";
 }
 
+// This is a regression test for https://crbug.com/668808
+TEST_F(ReplaceSelectionCommandTest, pasteSpanInText) {
+  document().setDesignMode("on");
+  setBodyContent("<b>text</b>");
+
+  Element* bElement = document().querySelector("b");
+  LocalFrame* frame = document().frame();
+  frame->selection().setSelection(
+      SelectionInDOMTree::Builder()
+          .collapse(Position(bElement->firstChild(), 1))
+          .build());
+
+  DocumentFragment* fragment = document().createDocumentFragment();
+  fragment->parseHTML("<span><div>bar</div></span>", bElement);
+
+  ReplaceSelectionCommand::CommandOptions options = 0;
+  ReplaceSelectionCommand* command =
+      ReplaceSelectionCommand::create(document(), fragment, options);
+
+  EXPECT_TRUE(command->apply()) << "the replace command should have succeeded";
+  EXPECT_EQ("<b>t</b>bar<b>ext</b>", document().body()->innerHTML())
+      << "'bar' should have been inserted";
+}
+
 // This is a regression test for https://crbug.com/121163
 TEST_F(ReplaceSelectionCommandTest, styleTagsInPastedHeadIncludedInContent) {
   document().setDesignMode("on");