After editing text in Tiny MCE then navigated to a different page, selecting undo typing from the Edit menu results in crash. This crash occurs with TOT Webkit.
STEPS TO REPRODUCE
1. With TOT Webkit, go to http://tinymce.moxiecode.com/example_full.php?example=true
2. Place caret in textarea field and type a few characters
3. Navigate to another page
4. Select Undo Typing from the Edit menu. A crash occurs.
Undo Typing should not be active after different page has been loaded. However, Undo Typing menu item is active and results in a crash when selected.
This bug is also in Radar as <rdar://4433765>
Created attachment 6806 [details]
undo/redo operations registered by subframes weren't cleared on a location change. clearUndoRedoOperations was only called from didOpenURL, and thus was only called for the main frame. At first I tried calling it for all childFrames in didOpenURL, but by the time that didOpenURL is called, all of the subframes have already been detached/destroyed. So I moved the call to clearUndoRedoOperations to closeURL, and it is now called for subframes as they are detached.