Adjust insertion point when listifying unordered list items

third_party/WebKit/Source/core/editing/commands/InsertListCommand.cpp

Index: third_party/WebKit/Source/core/editing/commands/InsertListCommand.cpp
diff --git a/third_party/WebKit/Source/core/editing/commands/InsertListCommand.cpp b/third_party/WebKit/Source/core/editing/commands/InsertListCommand.cpp
index c5bea18bc499cead96eb908dc5373a93a5d90df4..23a25f842ba74b45c22a1b87a3b23338ca128fbd 100644
--- a/third_party/WebKit/Source/core/editing/commands/InsertListCommand.cpp
+++ b/third_party/WebKit/Source/core/editing/commands/InsertListCommand.cpp
@@ -608,6 +608,17 @@ void InsertListCommand::listifyParagraph(const VisiblePosition& originalStart,
   // inline ancestors of start, since it is easier for editing to produce
   // clean markup when inline elements are pushed down as far as possible.
   Position insertionPos(mostBackwardCaretPosition(startPos));
+  // Also avoid the temporary <span> element created by 'unlistifyParagraph'.
+  // This element can be selected by mostBackwardCaretPosition when startPor
+  // points to a element with previous siblings or ancestors with siblings.
+  // |-A
+  // | |-B
+  // | +-C (insertion point)
+  // |   |-D (*)
+  if (isHTMLSpanElement(insertionPos.anchorNode())) {
+    insertionPos =
+        Position::inParentBeforeNode(*insertionPos.computeContainerNode());
+  }
   // Also avoid the containing list item.
   Node* const listChild = enclosingListChild(insertionPos.anchorNode());
   if (isHTMLLIElement(listChild))