Created attachment 106117 [details] Repro Repro (can probably be reduced further): <!DOCTYPE html><script> setTimeout(function() { document.execCommand("selectall"); document.designMode="on"; document.execCommand("indent", false); document.execCommand("outdent",false); document.execCommand("InsertImage",false); document.execCommand("Delete",false); document.execCommand("insertorderedlist",false); document.execCommand("delete"); document.execCommand("inserthorizontalrule",false); document.execCommand("InsertImage",false); document.execCommand("inserthorizontalrule",false); document.execCommand("insertunorderedlist"); document.execCommand("selectall",false); document.execCommand("insertorderedlist",false); document.execCommand("Delete",false); document.execCommand("selectall"); document.execCommand("outdent"); document.execCommand("insertimage",false); }, 100); </script><frameset><frame> id: chrome.dll!WebCore::positionAvoidingPrecedingNodes ReadAV@NULL (586c6d571697e9318ad053888f701434) description: Attempt to read from unallocated NULL pointer in chrome.dll!WebCore::positionAvoidingPrecedingNodes stack: chrome.dll!WebCore::positionAvoidingPrecedingNodes chrome.dll!WebCore::ReplaceSelectionCommand::doApply chrome.dll!WebCore::EditCommand::apply chrome.dll!WebCore::applyCommand ...