LayoutTests:

LayoutTests:

        Reviewed by darin

        <rdar://problem/5142012>
        GoogleDocs: Crash at WebCore::Range::startPosition() when creating a list from a link

        Tests the change to pushAnchorElementDown, where we remove
        the anchor element that has had copies of it pushed down:
        * editing/execCommand/5142012-1-expected.checksum: Added.
        * editing/execCommand/5142012-1-expected.png: Added.
        * editing/execCommand/5142012-1-expected.txt: Added.
        * editing/execCommand/5142012-1.html: Added.

        Demonstrates the crash (fixed by adding nil-checks
        to moveParagraphs):
        * editing/execCommand/5142012-2-expected.checksum: Added.
        * editing/execCommand/5142012-2-expected.png: Added.
        * editing/execCommand/5142012-2-expected.txt: Added.
        * editing/execCommand/5142012-2.html: Added.

        Tests the changes to positionAvoidingSpecialElementBoundary,
        where we push down anchors before we avoid them so that
        we don't also avoid structural elements like lists and paragraphs:
        * editing/execCommand/5142012-3-expected.checksum: Added.
        * editing/execCommand/5142012-3-expected.png: Added.
        * editing/execCommand/5142012-3-expected.txt: Added.
        * editing/execCommand/5142012-3.html: Added.

WebCore:

        Reviewed by darin

        <rdar://problem/5142012>
        GoogleDocs: Crash at WebCore::Range::startPosition() when creating a list from a link

        List creation uses moveParagraphs to push content into list items.
        Its fragment creation (using createMarkup) incorrectly uses regular
        spaces instead of nbsps for spaces that were rendered (11475), which
        causes spaces to be collapsed during the move operation.  This results
        in a call to rangeFromLocationAndLength with a location past the end
        of the document.  We use the result from rangeFromLocationAndLength
        (null) and crash.

        Also when moveParagraphs tries to push content into a list item surrounded
        by an anchor, it fails because positionAvoidingSpecialElementBoundary avoids
        the anchor, which also avoids the list item.  This was fixed by pushing
        down anchors before avoiding them.

        * editing/CompositeEditCommand.cpp:
        (WebCore::CompositeEditCommand::pushAnchorElementDown): Remove the
        old anchor after we push down clones of it, this is what callers
        expect.
        (WebCore::CompositeEditCommand::pushPartiallySelectedAnchorElementsDown):
        Call the new enclosingAnchorElement, that takes in a position instead
        of a node.
        (WebCore::CompositeEditCommand::moveParagraphs): If spaces collapsed
        as a result of the move, rangeFromLocationAndLength can return null,
        bail and don't try to preserve the selection in that case.
        (WebCore::CompositeEditCommand::positionAvoidingSpecialElementBoundary):
        Moved from htmlediting.cpp.
        Make sure anchors are pushed down before avoiding them so that we don't
        also avoid structural elements like lists and blocks.
        * editing/CompositeEditCommand.h:
        * editing/TypingCommand.cpp: Moved isFirst/LastPositionBefore/AfterTable
        to htmlediting.cpp.
        * editing/htmlediting.cpp:
        Moved positionAvoidingSpecialElementBoundary so that it could call
        pushAnchorElementDown.
        (WebCore::isFirstPositionAfterTable): Moved here.
        (WebCore::isLastPositionBeforeTable): Moved here.
        (WebCore::enclosingAnchorElement): Moved here.
        (WebCore::enclosingListChild): Removed an extraneous space.
        * editing/htmlediting.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@20958 268f45cc-cd09-0410-ab3c-d52691b4dbfc