crash in previousRootInlineBox due to pass in shadowRoot node to create legacy position.
Created attachment 113740 [details] patch w/ layout test
Comment on attachment 113740 [details] patch w/ layout test View in context: https://bugs.webkit.org/attachment.cgi?id=113740&action=review > LayoutTests/editing/selection/move-by-word-visually-crash-test-textarea.html:4 > + try { Why do we need try? > LayoutTests/editing/selection/move-by-word-visually-crash-test-textarea.html:16 > + sel = window.getSelection(); > + sel.modify("move", "left", "-webkit-visual-word"); > + sel.modify("move", "left", "-webkit-visual-word"); This can be written as: getSelection().modify("move", "left", "-webkit-visual-word"); getSelection().modify("move", "left", "-webkit-visual-word");
Committed r99886: <http://trac.webkit.org/changeset/99886>