Reduction: <!DOCTYPE html> <body> </body> <script type="text/javascript"> document.designMode = 'on'; document.execCommand("SelectAll"); document.documentElement.removeChild(document.body); document.execCommand("FormatBlock", false, "div"); </script> http://code.google.com/p/chromium/issues/detail?id=123441
Created attachment 138961 [details] Fixes the crash
Comment on attachment 138961 [details] Fixes the crash Clearing flags on attachment: 138961 Committed r115461: <http://trac.webkit.org/changeset/115461>
All reviewed patches have been landed. Closing bug.