In platform/mac/editing/input/selection-change-closes-typing.html, we do: textInputController.setMarkedText("P", 1, 0); testInput.value="PAS"; eventSender.keyDown("S"); but it should read: textInputController.setMarkedText("P", 0, 1); testInput.value="PAS"; eventSender.keyDown("S"); because textInput initially has no value, and the marked text must be inserted at offset 0 with length 1, not at offset 1 with length 0.
Created attachment 84320 [details] fixes the bug
Thanks for the review, Alexey!
Committed r80064: <http://trac.webkit.org/changeset/80064>
This got reverted in bug 56588.