5 files changed, 31 insertions, 7 deletions
diff --git a/WebCore/editing/CompositeEditCommand.cpp b/WebCore/editing/CompositeEditCommand.cpp
index 06cfd2b..602ca0f 100644
--- a/WebCore/editing/CompositeEditCommand.cpp
+++ b/WebCore/editing/CompositeEditCommand.cpp
@@ -776,8 +776,8 @@ void CompositeEditCommand::cloneParagraphUnderNewElement(Position& start, Positi
             outerNode = outerNode->parentNode();
             topNode = topNode->parentNode();
         }
-            
-        for (Node* n = start.node()->traverseNextSibling(outerNode); n; n = n->nextSibling()) {
+
+        for (Node* n = start.node()->traverseNextSibling(outerNode); n; n = n->traverseNextSibling(outerNode)) {
             if (n->parentNode() != start.node()->parentNode())
                 lastNode = topNode->lastChild();
 
diff --git a/WebCore/editing/InsertListCommand.cpp b/WebCore/editing/InsertListCommand.cpp
index f90d5d3..bb3cd93 100644
--- a/WebCore/editing/InsertListCommand.cpp
+++ b/WebCore/editing/InsertListCommand.cpp
@@ -156,6 +156,11 @@ void InsertListCommand::doApply()
                 doApplyForSingleParagraph(forceCreateList, listTag, currentSelection.get());
                 if (endOfSelection.isNull() || endOfSelection.isOrphan() || startOfLastParagraph.isNull() || startOfLastParagraph.isOrphan()) {
                     RefPtr<Range> lastSelectionRange = TextIterator::rangeFromLocationAndLength(document()->documentElement(), indexForEndOfSelection, 0, true);
+                    // If lastSelectionRange is null, then some contents have been deleted from the document.
+                    // This should never happen and if it did, exit early immediately because we've lost the loop invariant.
+                    ASSERT(lastSelectionRange);
+                    if (!lastSelectionRange)
+                        return;
                     endOfSelection = lastSelectionRange->startPosition();
                     startOfLastParagraph = startOfParagraph(endOfSelection);
                 }
diff --git a/WebCore/editing/InsertTextCommand.h b/WebCore/editing/InsertTextCommand.h
index 650ca65..24c2454 100644
--- a/WebCore/editing/InsertTextCommand.h
+++ b/WebCore/editing/InsertTextCommand.h
@@ -54,6 +54,8 @@ private:
     bool performTrivialReplace(const String&, bool selectInsertedText);
 
     unsigned m_charactersAdded;
+
+    friend class TypingCommand;
 };
 
 } // namespace WebCore
diff --git a/WebCore/editing/TypingCommand.cpp b/WebCore/editing/TypingCommand.cpp
index c596353..3cc8705 100644
--- a/WebCore/editing/TypingCommand.cpp
+++ b/WebCore/editing/TypingCommand.cpp
@@ -91,6 +91,7 @@ void TypingCommand::deleteKeyPressed(Document *document, bool smartDelete, TextG
     
     EditCommand* lastEditCommand = frame->editor()->lastEditCommand();
     if (granularity == CharacterGranularity && isOpenForMoreTypingCommand(lastEditCommand)) {
+        updateSelectionIfDifferentFromCurrentSelection(static_cast<TypingCommand*>(lastEditCommand), frame);
         static_cast<TypingCommand*>(lastEditCommand)->deleteKeyPressed(granularity, killRing);
         return;
     }
@@ -110,6 +111,7 @@ void TypingCommand::forwardDeleteKeyPressed(Document *document, bool smartDelete
     
     EditCommand* lastEditCommand = frame->editor()->lastEditCommand();
     if (granularity == CharacterGranularity && isOpenForMoreTypingCommand(lastEditCommand)) {
+        updateSelectionIfDifferentFromCurrentSelection(static_cast<TypingCommand*>(lastEditCommand), frame);
         static_cast<TypingCommand*>(lastEditCommand)->forwardDeleteKeyPressed(granularity, killRing);
         return;
     }
@@ -119,6 +121,18 @@ void TypingCommand::forwardDeleteKeyPressed(Document *document, bool smartDelete
     typingCommand->apply();
 }
 
+void TypingCommand::updateSelectionIfDifferentFromCurrentSelection(TypingCommand* typingCommand, Frame* frame)
+{
+    ASSERT(frame);
+    VisibleSelection currentSelection = frame->selection()->selection();
+    if (currentSelection == typingCommand->endingSelection())
+        return;
+    
+    typingCommand->setStartingSelection(currentSelection);
+    typingCommand->setEndingSelection(currentSelection);
+}
+    
+
 void TypingCommand::insertText(Document* document, const String& text, bool selectInsertedText, bool insertedTextIsComposition)
 {
     ASSERT(document);
@@ -129,6 +143,7 @@ void TypingCommand::insertText(Document* document, const String& text, bool sele
     insertText(document, text, frame->selection()->selection(), selectInsertedText, insertedTextIsComposition);
 }
 
+// FIXME: We shouldn't need to take selectionForInsertion. It should be identical to SelectionController's current selection.
 void TypingCommand::insertText(Document* document, const String& text, const VisibleSelection& selectionForInsertion, bool selectInsertedText, bool insertedTextIsComposition)
 {
 #if REMOVE_MARKERS_UPON_EDITING
@@ -163,15 +178,11 @@ void TypingCommand::insertText(Document* document, const String& text, const Vis
     RefPtr<EditCommand> lastEditCommand = frame->editor()->lastEditCommand();
     if (isOpenForMoreTypingCommand(lastEditCommand.get())) {
         TypingCommand* lastTypingCommand = static_cast<TypingCommand*>(lastEditCommand.get());
-        if (changeSelection) {
+        if (lastTypingCommand->endingSelection() != selectionForInsertion) {
             lastTypingCommand->setStartingSelection(selectionForInsertion);
             lastTypingCommand->setEndingSelection(selectionForInsertion);
         }
         lastTypingCommand->insertText(newText, selectInsertedText);
-        if (changeSelection) {
-            lastTypingCommand->setEndingSelection(currentSelection);
-            frame->selection()->setSelection(currentSelection);
-        }
         return;
     }
 
@@ -371,6 +382,10 @@ void TypingCommand::insertTextRunWithoutNewlines(const String &text, bool select
         command = InsertTextCommand::create(document());
         applyCommandToComposite(command);
     }
+    if (endingSelection() != command->endingSelection()) {
+        command->setStartingSelection(endingSelection());
+        command->setEndingSelection(endingSelection());
+    }
     command->input(text, selectInsertedText);
     typingAddedToOpenCommand(InsertText);
 }
diff --git a/WebCore/editing/TypingCommand.h b/WebCore/editing/TypingCommand.h
index 60b5f2a..284ebc0 100644
--- a/WebCore/editing/TypingCommand.h
+++ b/WebCore/editing/TypingCommand.h
@@ -81,6 +81,8 @@ private:
     virtual bool isTypingCommand() const;
     virtual bool preservesTypingStyle() const { return m_preservesTypingStyle; }
 
+    static void updateSelectionIfDifferentFromCurrentSelection(TypingCommand*, Frame*);
+
     void updatePreservesTypingStyle(ETypingCommand);
     void markMisspellingsAfterTyping(ETypingCommand);
     void typingAddedToOpenCommand(ETypingCommand);