Opening the attached test case results in a crash in release builds, or an assertion failure in debug: #0 0x03b3d6df in WebCore::CompositeEditCommand::moveParagraphs at CompositeEditCommand.cpp:815 #1 0x03b3e21b in WebCore::CompositeEditCommand::moveParagraph at CompositeEditCommand.cpp:747 #2 0x042db177 in WebCore::ReplaceSelectionCommand::mergeEndIfNeeded at ReplaceSelectionCommand.cpp:699 #3 0x042df692 in WebCore::ReplaceSelectionCommand::doApply at ReplaceSelectionCommand.cpp:960 #4 0x03d37ae3 in WebCore::EditCommand::apply at EditCommand.cpp:91 #5 0x03d37b77 in WebCore::applyCommand at EditCommand.cpp:217 #6 0x03d47097 in WebCore::executeInsertFragment at EditorCommand.cpp:196 #7 0x03d47122 in WebCore::executeInsertHTML at EditorCommand.cpp:479 #8 0x03d43d1f in WebCore::Editor::Command::execute at EditorCommand.cpp:1504 #9 0x03c45edd in WebCore::Document::execCommand at Document.cpp:3241 #10 0x03f509a2 in WebCore::jsDocumentPrototypeFunctionExecCommand at JSDocument.cpp:1867 In real life, this happens when pasting into a contenteditable div. <rdar://7148712>
Created attachment 39102 [details] reduced test case (will crash)
Created attachment 40545 [details] Patch
Comment on attachment 40545 [details] Patch r=me! I'll commit this.
Committed revision 49041.