A workaround fix for Issue 9186....

webkit/glue/webview_impl.cc

 /*
 * Copyright 2007 Google Inc. All Rights Reserved.
 *
 * Portions Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 *
 * ***** BEGIN LICENSE BLOCK *****
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
@@ skipping 1386 matching lines @@
   settings->setFontRenderingMode(NormalRenderingMode);
   settings->setJavaEnabled(preferences.java_enabled);
 
   // Turn this on to cause WebCore to paint the resize corner for us.
   settings->setShouldPaintCustomScrollbars(true);
 
   // Mitigate attacks from local HTML files by not granting file:// URLs
   // universal access.
   settings->setAllowUniversalAccessFromFileURLs(false);
 
+  // We prevent WebKit from checking if it needs to add a "text direction"
+  // submenu to a context menu. it is not only because we don't need the result
+  // but also because it cause a possible crash in Editor::hasBidiSelection().
+  settings->setTextDirectionSubmenuInclusionBehavior(
+      TextDirectionSubmenuNeverIncluded);
+
 #if defined(OS_WIN)
   // RenderTheme is a singleton that needs to know the default font size to
   // draw some form controls.  We let it know each time the size changes.
   WebCore::RenderThemeChromiumWin::setDefaultFontSize(preferences.default_font_size);
 #endif
 }
 
 const WebPreferences& WebViewImpl::GetPreferences() {
   return webprefs_;
 }
@@ skipping 395 matching lines @@
 
   return document->focusedNode();
 }
 
 HitTestResult WebViewImpl::HitTestResultForWindowPos(const IntPoint& pos) {
   IntPoint doc_point(
       page_->mainFrame()->view()->windowToContents(pos));
   return page_->mainFrame()->eventHandler()->
       hitTestResultAtPoint(doc_point, false);
 }