Reviewed by Tony Chang, Darin Adler, and Enrica Casucci.

        REGRESSION(r81887): Crash in SplitElement
        https://bugs.webkit.org/show_bug.cgi?id=57743

        The crash was caused by ReplaceSelectionCommand::doApply's calling splitElement with computeNodeAfterPosition
        even when the position was after the last node in it container. Since all we are doing here is to splitting tree
        up until the highest ancestor with isInlineNodeWithStyle, replaced the while loop by calls to splitTreeToNode
        and highestEnclosingNodeOfType.

        Also fixed a bug in splitTreeToNode not to check the difference in visible position when splitting the ancestor,
        which would have introduced unnecessary nodes when splitting tree and a bug in highestEnclosingNodeOfType that
        it incorrectly called deprecatedNode instead of containerNode.

        Test: editing/inserting/insert-images-in-pre-x-crash.html

        * editing/CompositeEditCommand.cpp:
        (WebCore::CompositeEditCommand::splitTreeToNode):
        * editing/ReplaceSelectionCommand.cpp:
        (WebCore::ReplaceSelectionCommand::doApply):
        * editing/htmlediting.cpp:
        (WebCore::highestEnclosingNodeOfType):
2011-04-08  Ryosuke Niwa  <rniwa@webkit.org>

        Reviewed by Tony Chang, Darin Adler, and Enrica Casucci.

        REGRESSION(r81887): Crash in SplitElement
        https://bugs.webkit.org/show_bug.cgi?id=57743

        Added a regression test for a crash in ReplaceSelectionCommand.

        * editing/inserting/insert-images-in-pre-x-crash-expected.txt: Added.
        * editing/inserting/insert-images-in-pre-x-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@83322 268f45cc-cd09-0410-ab3c-d52691b4dbfc