Don't come undone when undoing the editing of a Custom Element.

Source/core/dom/CustomElementRegistrationContext.cpp

Index: Source/core/dom/CustomElementRegistrationContext.cpp
diff --git a/Source/core/dom/CustomElementRegistrationContext.cpp b/Source/core/dom/CustomElementRegistrationContext.cpp
index 3e37396aea71337bb64b9d39b28da6e2b52c1d0a..4589e7e1c1c88d6f91b046b6df06e9bc0bbf1980 100644
--- a/Source/core/dom/CustomElementRegistrationContext.cpp
+++ b/Source/core/dom/CustomElementRegistrationContext.cpp
@@ -134,8 +134,17 @@ void CustomElementRegistrationContext::setTypeExtension(Element* element, const
     if (!element->isHTMLElement() && !element->isSVGElement())
         return;
 
-    if (CustomElement::isCustomTagName(element->localName()))
-        return; // custom tags take precedence over type extensions
+    if (element->isCustomElement()) {
+        // This can happen if:
+        // 1. The element has a custom tag, which takes precedence over
+        //    type extensions.
+        // 2. Undoing a command (eg ReplaceNodeWithSpan) recycles an
+        //    element but tries to overwrite its attribute list.
+        return;
+    }
+
+    // Custom tags take precedence over type extensions
+    ASSERT(!CustomElement::isCustomTagName(element->localName()));
 
     if (CustomElementRegistrationContext* context = element->document()->registrationContext())
         context->didGiveTypeExtension(element, type);