Crashes in WebCore::ApplyStyleCommand.doApply()