The "outdent" feature of designMode causes WebKit to crash. Reproduction steps: 1. Go to http://www.mozilla.org/editor/midasdemo/ 2. In the content editing box, type "abcd" 3. While on the same line, select the insert ordered list button 4. Select the "indent" button 5. Select the "outdent" button. This will cause the crash.
The only crash I'm able to get out of the page is when closing it, not when interacting with the editor, which makes this look like a dupe of bug 11729.
I can reproduce at least an assertion failure: ASSERTION FAILED: selection.isCaretOrRange() (/Users/ap/WebKit/WebCore/editing/ReplaceSelectionCommand.cpp:456 virtual void WebCore::ReplaceSelectionCommand::doApply())
<rdar://problem/4928635>
Fixed in r19088.