Merge 94840 - Crashes in WebCore::ApplyStyleCommand.doApply()

Source/WebCore/editing/ApplyStyleCommand.cpp

 /*
  * Copyright (C) 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 263 matching lines @@
     VisiblePosition beyondEnd(endOfParagraph(visibleEnd).next());
     while (paragraphStart.isNotNull() && paragraphStart != beyondEnd) {
         StyleChange styleChange(style, paragraphStart.deepEquivalent());
         if (styleChange.cssStyle().length() || m_removeOnly) {
             RefPtr<Node> block = enclosingBlock(paragraphStart.deepEquivalent().deprecatedNode());
             if (!m_removeOnly) {
                 RefPtr<Node> newBlock = moveParagraphContentsToNewBlockIfNecessary(paragraphStart.deepEquivalent());
                 if (newBlock)
                     block = newBlock;
             }
-            ASSERT(block->isHTMLElement());
-            if (block->isHTMLElement()) {
+            ASSERT(!block || block->isHTMLElement());
+            if (block && block->isHTMLElement()) {
                 removeCSSStyle(style, toHTMLElement(block.get()));
                 if (!m_removeOnly)
                     addBlockStyle(styleChange, toHTMLElement(block.get()));
             }
 
             if (nextParagraphStart.isOrphan())
                 nextParagraphStart = endOfParagraph(paragraphStart).next();
         }
 
         paragraphStart = nextParagraphStart;
@@ skipping 1192 matching lines @@
         }
         else {
             child = child->nextSibling();
         }
     }
 
     updateStartEnd(newStart, newEnd);
 }
 
 }