HitTestResult::spellingToolTip() dereferences m_innerNonSharedNode which may be null. This causes the first assert in Node::document() to fail.
Created attachment 11377 [details] manual test case
Created attachment 11379 [details] Automatic test
Fixed with r17640.
Created attachment 11414 [details] Patch with the automated test Alexey suggested adding this test which is specific to the missing null check. The test that was included with the fix doesn't cover it, since the fix prevents a null m_innerNonSharedNode in that case.
Reopening for review.
Comment on attachment 11414 [details] Patch with the automated test good call!
Test committed revision 17642.