Fix the crash bug about selecting a marquee element.

LayoutTests/editing/execCommand/selectAll-including-marquee-crash.html

Index: LayoutTests/editing/execCommand/selectAll-including-marquee-crash.html
diff --git a/LayoutTests/editing/execCommand/selectAll-including-marquee-crash.html b/LayoutTests/editing/execCommand/selectAll-including-marquee-crash.html
new file mode 100644
index 0000000000000000000000000000000000000000..3478001a7b3070e5850e8e37bbf6b10c504980f9
--- /dev/null
+++ b/LayoutTests/editing/execCommand/selectAll-including-marquee-crash.html
@@ -0,0 +1,19 @@
+<style>

[leviw_travelin_and_unemployed, 2014/02/14 04:57:46]

Let's clean this up a bit more with a doctype and html tag.

[yoichio, 2014/02/19 08:00:30]

Done.

+    marquee {
+        padding-bottom: 1px;
+    }
+</style>
+

[leviw_travelin_and_unemployed, 2014/02/14 04:57:46]

And a body :)

[yoichio, 2014/02/19 08:00:30]

Done.

+<marquee>
+aa

[leviw_travelin_and_unemployed, 2014/02/14 04:57:46]

I suspect you could simply put "Test passes if it does not crash." here instead
of in an innerHTML call.

[yoichio, 2014/02/19 08:00:30]

This test case executes "SelectAll" and "InsertHTML". 
It replaces the existing content.

+<table></table>
+</marquee>
+
+<script>
+    if (window.testRunner)
+        testRunner.dumpAsText();
+    document.designMode = "on";
+    document.execCommand("SelectAll");
+    document.execCommand("InsertHTML", false);
+    document.documentElement.innerHTML = '<title>a</title>This test passes if it does not crash.';
+</script>