Created attachment 85906 [details] a repro How to reproduce: - open attached svg file - input some text into <textbox> left side - select the text and drag-n-drop it to <textbox> right side. Then assertion failed. Note that: - it doesn't crash but doesn't work as expected on Safari5 and Chrome12 dev. - the draggin text doesn't need to be from <textarea> just selecting some text and dropping it can repro the problem.
While there are some selection issues with SVG, the bug reported here no longer occurs in Chromium 17 dev, or a most recent debug build. No assertion or anything.