Created attachment 265201 [details] Test Load the attached test with debug MiniBrowser: a<font></font><li></li> <li></li> <embed></embed>a <base contenteditable="false"><base>a <time hidden><sub contenteditable="false"></sub></time> a <style> * { display:inline-grid-grid; } </style> <script> document.designMode = 'on'; document.execCommand("selectAll"); document.execCommand("indent"); document.execCommand("indent"); </script> OS: Ubuntu 15.04 x86_64 Checked build: debug EFL Checked version: 29ae33c Backtrace: ASSERTION FAILED: startIndex <= endIndex ../../Source/WebCore/editing/ApplyBlockElementCommand.cpp(92) : virtual void WebCore::ApplyBlockElementCommand::doApply() 1 0x7fb168b7489f WTFCrash 2 0x7fb16ff90e59 WebCore::ApplyBlockElementCommand::doApply() 3 0x7fb16ffa6f4c WebCore::CompositeEditCommand::apply() 4 0x7fb16ffa6cfd WebCore::applyCommand(WTF::PassRefPtr<WebCore::CompositeEditCommand>) 5 0x7fb16ee0b3a6 6 0x7fb16ee0f59e WebCore::Editor::Command::execute(WTF::String const&, WebCore::Event*) const 7 0x7fb16ecb3d39 WebCore::Document::execCommand(WTF::String const&, bool, WTF::String const&) 8 0x7fb1703e622d WebCore::jsDocumentPrototypeFunctionExecCommand(JSC::ExecState*) 9 0x7fb10b7ff0c8 Aborted (core dumped) Program terminated with signal SIGSEGV, Segmentation fault. #0 0x00007fe901d648a4 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321 321 *(int *)(uintptr_t)0xbbadbeef = 0; (gdb) bt #0 0x00007fe901d648a4 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321 #1 0x00007fe909180e59 in WebCore::ApplyBlockElementCommand::doApply (this=0x7fe8e92dc318) at ../../Source/WebCore/editing/ApplyBlockElementCommand.cpp:92 #2 0x00007fe909196f4c in WebCore::CompositeEditCommand::apply (this=0x7fe8e92dc318) at ../../Source/WebCore/editing/CompositeEditCommand.cpp:227 #3 0x00007fe909196cfd in WebCore::applyCommand (command=...) at ../../Source/WebCore/editing/CompositeEditCommand.cpp:186 #4 0x00007fe907ffb3a6 in WebCore::executeIndent (frame=...) at ../../Source/WebCore/editing/EditorCommand.cpp:456 #5 0x00007fe907fff59e in WebCore::Editor::Command::execute (this=0x7ffdf0ce66f0, parameter=..., triggeringEvent=0x0) at ../../Source/WebCore/editing/EditorCommand.cpp:1703 #6 0x00007fe907ea3d39 in WebCore::Document::execCommand (this=0x7fe8e9024940, commandName=..., userInterface=false, value=...) at ../../Source/WebCore/dom/Document.cpp:4657 #7 0x00007fe9095d622d in WebCore::jsDocumentPrototypeFunctionExecCommand (state=0x7ffdf0ce67c0) at DerivedSources/WebCore/JSDocument.cpp:5066 #8 0x00007fe8a3fff0c8 in ?? () #9 0x00007ffdf0ce6830 in ?? () #10 0x00007fe901d0d036 in llint_entry () from webkit/WebKitBuild/Debug/lib/libjavascriptcore_efl.so.1
This does not reproduce in r204037. If you feel that there is still an issue, please reopen the bug and attach a revised test case.