Use-after-free in CompositeEditCommand::cloneParagraphUnderNewElement