Tested on Windows 7 using chrome stable M49-49.0.2623.87 and chrome canary M51-51.0.2688.0, Observed the dom is different while clicking the replace button.

Tested the same on previous version of chrome M35-35.0.1851.0, Observed no replace button displayed to check the issue. It's seen only after chrome M49 versions, so considering it as non-regression and marking it as untriaged.

Thanks!

it happens only when h1 is the first element, so not here https://jsfiddle.net/crl/gvau4uc8/3/
if it helps

This issue has been Available for over a year. If it's no longer important or seems unlikely to be fixed, please consider closing it out. If it is important, please re-triage the issue.

Sorry for the inconvenience if the bug really should have been left as Available. If you change it back, also remove the "Hotlist-Recharge-Cold" label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Simplify test.
<button id="replace">
  replace
</button>
<div id="foo" contenteditable>
  <h1> World</h1><ul><li>rips br's without our consent</li></ul>
</div>
<script>

replace.addEventListener('click', e=>{
  foo.focus();
  document.execCommand('selectAll');
  document.execCommand('insertHTML',null, `<h1> World</h1><ul><li>rips br's without our consent</li>
	      </ul>`);
});

This issue has been Available for over a year. If it's no longer important or seems unlikely to be fixed, please consider closing it out. If it is important, please re-triage the issue.

Sorry for the inconvenience if the bug really should have been left as Available.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot