Fix an assertion failure in HTMLTextAreaElement::subtreeHasChanged.

Selection.deleteFromDocument() leaves an empty Text node in innerEditor of
TEXTAREA element, and InsertLineBreakCommand inserted a placeholder BR element
*before* the empty Text node.  It broke the assumption of TEXTAREA element.

This CL makes sure the BR element is appended at the last.

BUG=623547

Review-Url: https://codereview.chromium.org/2125553002
Cr-Commit-Position: refs/heads/master@{#403853}
2 files changed