LayoutTests:

LayoutTests:

        Reviewed by sullivan

        <rdar://problem/4845371>
        In Mail, a crash occurs at WebCore::Node::traverseNextNode() when cutting selected text from a HTML message

        * editing/deleting/4845371-expected.checksum: Added.
        * editing/deleting/4845371-expected.png: Added.
        * editing/deleting/4845371-expected.txt: Added.
        * editing/deleting/4845371.html: Added.

WebCore:

        Reviewed by sullivan

        <rdar://problem/4845371>
        In Mail, a crash occurs at WebCore::Node::traverseNextNode() when cutting selected text from a HTML message

        * editing/DeleteSelectionCommand.cpp:
        (WebCore::DeleteSelectionCommand::initializeStartEnd): The start/end were
        being inflated even when they were the start/end of a partially selected
        special element.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@17936 268f45cc-cd09-0410-ab3c-d52691b4dbfc