Range: surroundContents() should postpone DOM mutation events.

third_party/WebKit/Source/core/dom/Range.cpp

Index: third_party/WebKit/Source/core/dom/Range.cpp
diff --git a/third_party/WebKit/Source/core/dom/Range.cpp b/third_party/WebKit/Source/core/dom/Range.cpp
index ddc3f33db165149f0f212c3597461b298dd1f1a3..57de739ef4e668c656ffeae75f5766f02a518a25 100644
--- a/third_party/WebKit/Source/core/dom/Range.cpp
+++ b/third_party/WebKit/Source/core/dom/Range.cpp
@@ -1388,6 +1388,8 @@ void Range::surroundContents(Node* newParent, ExceptionState& exceptionState) {
     return;
   }
 
+  EventQueueScope scope;
+
   // 4. If newParent has children, replace all with null within newParent.
   while (Node* n = newParent->firstChild()) {
     toContainerNode(newParent)->removeChild(n, exceptionState);