In a plain text paste, we do 3 layouts, one for the test insertion, a second after the test insertion to remove the fragment from the document, and another after the paste is complete. Leaving the fragment in the document after the test insertion avoids the second layout. It also lets us get rid of isProbablyBlock.
Created attachment 7226 [details] patch I want the ReplacementFragment to be destroyed and the holder removed when the paste is complete, so I made it a local variable inside doApply(). It was previously a member variable of ReplaceSelectionCommand, so it wasn't destroyed until the undo stack was cleared. Added a layout test that demonstrates why it is important to get rid of isProbablyBlock. The test does a copy/paste of a selection that starts and ends inside spans with style="display:block".
This patch breaks a layout test: editing/pasteboard/paste-empty-startcontainer.html, but only because it exposes a bug in FrameTree:uniqueChildName, which I filed (7899). I'll disable that test.
Comment on attachment 7226 [details] patch r=me