Detailed report: https://cluster-fuzz.appspot.com/testcase?key=15995435 Uploader: skylined@chromium.org Crash Type: UNKNOWN Crash Address: 0x000000000640 Crash State: - crash stack - WebCore::Editor::isContinuousSpellCheckingEnabled WebCore::TypingCommand::markMisspellingsAfterTyping WebCore::TypingCommand::deleteKeyPressed Regressed: https://cluster-fuzz.appspot.com/revisions?range=108839:108881 Minimized Testcase (2.51 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97_6CG2EXf7_BvtuY37u9sW7LsAnpGs24_teSavkXZd63UaqnEhn4dOtvwivAnbWfjelfuaA7MHdkhw_xPurz9EsNGHYTkX3ueLfLNzC-KrWozIUYOUHDOw5LnJQTjMryYUyOFSYPxgOfS8WglSoOeZ63Tdzg
Created attachment 125269 [details] Patch
I couldn't reproduce this locally. But code indicates this is possible.
Comment on attachment 125269 [details] Patch Clearing flags on attachment: 125269 Committed r106646: <http://trac.webkit.org/changeset/106646>
All reviewed patches have been landed. Closing bug.