Passing ownerless node to DOMSelection APIs including collapse(), extend(), selectAllChildren(), setPosition() causes a crash. One type of ownerless node is newly-created DocumentType object. This is similar to Bug 31680 and the fix on Bug 31680 will fix these. But we need regressions for that.
Created attachment 52015 [details] to reproduce
Fixed at http://trac.webkit.org/changeset/56962