Make sure calling moveParagaph() with proper parameters in CompositeEditCommand::moveParagraphConten

Source/core/editing/CompositeEditCommand.cpp

 /*
  * Copyright (C) 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 932 matching lines @@
         }
     }
 
     if (visibleParagraphEnd.isNull())
         return nullptr;
 
     RefPtrWillBeRawPtr<Node> newBlock = insertNewDefaultParagraphElementAt(upstreamStart);
 
     bool endWasBr = isHTMLBRElement(*visibleParagraphEnd.deepEquivalent().deprecatedNode());
 
+    // Inserting default paragraph element can change visible position. We
+    // should update visible positions before use them.
+    visiblePos = VisiblePosition(pos, VP_DEFAULT_AFFINITY);
+    visibleParagraphStart = VisiblePosition(startOfParagraph(visiblePos));
+    visibleParagraphEnd = VisiblePosition(endOfParagraph(visiblePos));
     moveParagraphs(visibleParagraphStart, visibleParagraphEnd, VisiblePosition(firstPositionInNode(newBlock.get())));
 
     if (newBlock->lastChild() && isHTMLBRElement(*newBlock->lastChild()) && !endWasBr)
         removeNode(newBlock->lastChild());
 
     return newBlock.release();
 }
 
 void CompositeEditCommand::pushAnchorElementDown(Node* anchorNode)
 {
@@ skipping 529 matching lines @@
 }
 
 void CompositeEditCommand::trace(Visitor* visitor)
 {
     visitor->trace(m_commands);
     visitor->trace(m_composition);
     EditCommand::trace(visitor);
 }
 
 } // namespace WebCore