The new(ish) m_textDirectionSubmenuInclusionBehavior member of Settings isn't initialized. This shows up when running editing/selection/5354455-1.html. (It was caught in Chromium running under Purify, as it happens, but that's not pertinent here.)
Created attachment 26133 [details] Add initializer to ctor I wasn't certain which of the three choices to initialize this to. Please verify my guess.
Landed in r39387.