Abort CompositeEditCommand::moveParagraphs if destination is inside moving range

This patch makes CompositeEditCommand::moveParagraphs abort in the above
mentioned case, because there is no way to move the contents to a destination
inside itself.

There might be a deeper cause of passing such invalid parameter combination
to the function, which is not covered by this patch.

BUG=585048
TEST=webkit_unit_tests --gtest_filter=TypingCommandTest.insertLineBreakWithIllFormedHTML

Review-Url: https://codereview.chromium.org/2531263002
Cr-Commit-Position: refs/heads/master@{#434844}

third_party/WebKit/Source/core/BUILD.gn

@@ -1163,6 +1163,7 @@ source_set("unit_tests") {
     "editing/commands/ApplyBlockElementCommandTest.cpp",
     "editing/commands/InsertListCommandTest.cpp",
     "editing/commands/ReplaceSelectionCommandTest.cpp",
+    "editing/commands/TypingCommandTest.cpp",
     "editing/iterators/BackwardsTextBufferTest.cpp",
     "editing/iterators/CharacterIteratorTest.cpp",
     "editing/iterators/ForwardsTextBufferTest.cpp",

third_party/WebKit/Source/core/editing/commands/CompositeEditCommand.cpp

@@ -1511,6 +1511,14 @@ void CompositeEditCommand::moveParagraphs(
       startOfParagraphToMove.isNull())
     return;
 
+  // Can't move the range to a destination inside itself.
+  if (destination.deepEquivalent() > startOfParagraphToMove.deepEquivalent() &&
+      destination.deepEquivalent() < endOfParagraphToMove.deepEquivalent()) {
+    // Reached by unit test TypingCommandTest.insertLineBreakWithIllFormedHTML
+    editingState->abort();
+    return;
+  }
+
   int startIndex = -1;
   int endIndex = -1;
   int destinationIndex = -1;

third_party/WebKit/Source/core/editing/commands/TypingCommand.h

@@ -30,7 +30,7 @@
 
 namespace blink {
 
-class TypingCommand final : public CompositeEditCommand {
+class CORE_EXPORT TypingCommand final : public CompositeEditCommand {
  public:
   enum ETypingCommand {
     DeleteSelection,

third_party/WebKit/Source/core/editing/commands/TypingCommandTest.cpp

+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "core/editing/commands/TypingCommand.h"
+
+#include "bindings/core/v8/ExceptionState.h"
+#include "core/dom/Document.h"
+#include "core/editing/EditingTestBase.h"
+#include "core/editing/FrameSelection.h"
+#include "core/editing/Position.h"
+#include "core/editing/VisibleSelection.h"
+#include "core/frame/FrameView.h"
+#include "core/frame/LocalFrame.h"
+#include "core/testing/DummyPageHolder.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+#include <memory>
+
+namespace blink {
+
+class TypingCommandTest : public EditingTestBase {};
+
+// This is a regression test for https://crbug.com/585048
+TEST_F(TypingCommandTest, insertLineBreakWithIllFormedHTML) {
+  setBodyContent("<div contenteditable></div>");
+
+  // <input><form></form></input>
+  Element* input1 = document().createElement("input");
+  Element* form = document().createElement("form");
+  input1->appendChild(form);
+
+  // <tr><input><header></header></input><rbc></rbc></tr>
+  Element* tr = document().createElement("tr");
+  Element* input2 = document().createElement("input");
+  Element* header = document().createElement("header");
+  Element* rbc = document().createElement("rbc");
+  input2->appendChild(header);
+  tr->appendChild(input2);
+  tr->appendChild(rbc);
+
+  Element* div = document().querySelector("div");
+  div->appendChild(input1);
+  div->appendChild(tr);
+
+  LocalFrame* frame = document().frame();
+  frame->selection().setSelection(SelectionInDOMTree::Builder()
+                                      .collapse(Position(form, 0))
+                                      .extend(Position(header, 0))
+                                      .build());
+
+  // Inserting line break should not crash or hit assertion.
+  TypingCommand::insertLineBreak(document());
+}
+
+}  // namespace blink