The new(ish) m_textDirectionSubmenuInclusionBehavior member of Settings isn't initialized. This shows up when running editing/selection/5354455-1.html.
(It was caught in Chromium running under Purify, as it happens, but that's not pertinent here.)
Created attachment 26133 [details]
Add initializer to ctor
I wasn't certain which of the three choices to initialize this to. Please verify my guess.
Landed in r39387.