I hit an assert when I select "dolor" and drag and drop it between "lorem" and "ipsum" in <input type="search" value="lorem ipsum dolor"> ASSERTION FAILED: value == constrainValue(value) || constrainValue(value).isEmpty() (WebCore/html/HTMLInputElement.cpp:1088 void WebCore::HTMLInputElement::setValueFromRenderer(const WebCore::String&))
<rdar://problem/4887416> REGRESSION (SearchField): Assertion failure in HTMLInputElement::setValueFromRenderer when editing via drag and drop (11846)
Fixed in r18944.