Cannot press Enter to escape from bulleted list when <ul> is a child of <li>.

[Annie Sullivan]

1. Go to Midas Demo: http://www.mozilla.org/editor/midasdemo/
2. Enter the following HTML (note <ul> is child of <li>):
<ul><li>item<ul><li>subitem</li></ul></li></ul>
3. Put cursor at end of "subitem" and press enter several times.

Actual result:
Cursor remains outdented, cannot escape <li>. Sample HTML after pressing enter several times:
<ul><li>item<ul><li>subitem</li></ul><div><br></div><div><br></div><div><br></div><div><br></div></li></ul>

Expected result:
Same as if the HTML was "<ul><li>item</li><ul><li>subitem</li></ul></ul>" (<ul> child of <ul>):
* First time pressing enter creates new list item under "subitem"
* Second time pressing enter outdents the list item (now under "item")
* Third time pressing enter outdents the list item, removing it entirely.

[Ryosuke Niwa]

Created attachment 34880 [details]
fixes the bug

[Eric Seidel (no email)]

Comment on attachment 34880 [details]
fixes the bug

Looks sane.  Ryosuke is a committer, he can set cq+ if he'd like the bot to commit it for him.  cq- for now.

[Ryosuke Niwa]

Landed as http://trac.webkit.org/changeset/47987.