Merge 73052 - 2010-12-01 Ryosuke Niwa <rniwa@webkit.org>...

WebCore/editing/InsertListCommand.cpp

 /*
  * Copyright (C) 2006, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 138 matching lines @@
 
                 // Save and restore endOfSelection and startOfLastParagraph when necessary
                 // since moveParagraph and movePragraphWithClones can remove nodes.
                 // FIXME: This is an inefficient way to keep selection alive because indexForVisiblePosition walks from
                 // the beginning of the document to the endOfSelection everytime this code is executed.
                 // But not using index is hard because there are so many ways we can lose selection inside doApplyForSingleParagraph.
                 int indexForEndOfSelection = indexForVisiblePosition(endOfSelection);
                 doApplyForSingleParagraph(forceCreateList, listTag, currentSelection.get());
                 if (endOfSelection.isNull() || endOfSelection.isOrphan() || startOfLastParagraph.isNull() || startOfLastParagraph.isOrphan()) {
                     RefPtr<Range> lastSelectionRange = TextIterator::rangeFromLocationAndLength(document()->documentElement(), indexForEndOfSelection, 0, true);
+                    // If lastSelectionRange is null, then some contents have been deleted from the document.
+                    // This should never happen and if it did, exit early immediately because we've lost the loop invariant.
+                    ASSERT(lastSelectionRange);
+                    if (!lastSelectionRange)
+                        return;
                     endOfSelection = lastSelectionRange->startPosition();
                     startOfLastParagraph = startOfParagraph(endOfSelection);
                 }
 
                 // Fetch the start of the selection after moving the first paragraph,
                 // because moving the paragraph will invalidate the original start.  
                 // We'll use the new start to restore the original selection after 
                 // we modified all selected paragraphs.
                 if (startOfCurrentParagraph == startOfSelection)
                     startOfSelection = endingSelection().visibleStart();
@@ skipping 210 matching lines @@
     if (listElement)
         return mergeWithNeighboringLists(listElement);
 
     if (canMergeLists(previousList, nextList))
         mergeIdenticalElements(previousList, nextList);
 
     return listElement;
 }
 
 }