Passing ownerless node to DOMSelection APIs including collapse(), extend(), selectAllChildren(), setPosition() causes a crash.
One type of ownerless node is newly-created DocumentType object.
This is similar to Bug 31680 and the fix on Bug 31680 will fix these. But we need regressions for that.
Created attachment 52015 [details]
Fixed at http://trac.webkit.org/changeset/56962