Merge https://chromium.googlesource.com/chromium/blink/+/c89b413ff0fc4aafa0c71d180b0b1e131bb37707 Code in Range::insertNode assumes that the start offset of the selection range within its container does not change across a call to insertBefore on the container, which is not true. This patch recomputes the start offset when it is used after the insertBefore call.
<rdar://problem/15401410>
Created attachment 216135 [details] Merges the fix
Comment on attachment 216135 [details] Merges the fix Clearing flags on attachment: 216135 Committed r158738: <http://trac.webkit.org/changeset/158738>
All reviewed patches have been landed. Closing bug.