Crashes in WebCore::RootInlineBox::childRemoved(WebCore::InlineBox*) + 23 (/Users/andersca/src/webkit/OpenSource/WebCore/rendering/RootInlineBox.cpp:154)
Does this still reproduce? I have almost completely rewritten RemoveFormatCommand so I'll be surprised if this bug still reproduces.
run-webkit-tests -g editing/execCommand/remove-formatting.html Seems fine in r70259.