This test started crashing after r39456 because the function CompositeEditCommand::mergeIdenticalElements now has PassRefPtr parameters and passes them into more then one other function, losing their value along the way. The fix is to store parameters in local RefPtr variables and use those.
Created attachment 26242 [details] Proposed patch
Comment on attachment 26242 [details] Proposed patch r=me Thanks for fixing the regression I caused!
Committed revision 39475.