Bug 238268

The following editing tests are failing an assertion on iOS debug bots:
editing/caret/caret-in-empty-cell.html
editing/deleting/5126166.html
editing/deleting/5206311-1.html
editing/deleting/5206311-2.html
editing/deleting/5433862-1.html
editing/deleting/backspace-at-table-cell-beginning.html
editing/deleting/delete-line-016.html
editing/deleting/forward-delete-empty-table-cell.html
editing/execCommand/5543472-3.html
editing/execCommand/5658933-1.html
editing/execCommand/break-out-of-empty-list-item.html
editing/execCommand/crash-deleting-after-inserting-text-horizontal-rule.html
editing/execCommand/insert-nested-lists-in-table.html
editing/selection/3690703-2.html
editing/selection/editable-table-cell-selection.html
editing/selection/inline-table.html
editing/selection/mixed-editability-12.html
editing/style/create-block-for-style-009.html
editing/unsupported-content/table-type-after.html

This appears to have started with https://commits.webkit.org/248760@main based on test result history

ASSERTION FAILED: areVisiblePositionsInSameTreeScope(result, vp) => useDownstream ? (result > vp) : (result < vp)
./editing/VisibleUnits.cpp(1707) : WebCore::VisiblePosition WebCore::nextSentenceBoundaryInDirection(const WebCore::VisiblePosition &, WebCore::SelectionDirection)
1   0x40a9d60e9 WTFCrash
2   0x4363a753a WebCore::nextSentenceBoundaryInDirection(WebCore::VisiblePosition const&, WebCore::SelectionDirection)
3   0x4363a6aaa WebCore::positionOfNextBoundaryOfGranularity(WebCore::VisiblePosition const&, WebCore::TextGranularity, WebCore::SelectionDirection)
4   0x3ee855ee6 WebKit::WebPage::autocorrectionContext()
5   0x3ee8567a8 WebKit::WebPage::preemptivelySendAutocorrectionContext()
6   0x3ef581a0b WebKit::WebPage::didChangeSelection(WebCore::Frame&)
7   0x3ee83bc1a WebKit::WebPage::updateSelectionAppearance()
8   0x3ef285421 WebKit::WebFrameLoaderClient::dispatchDidLayout()
9   0x436eaa8e9 WebCore::FrameView::performPostLayoutTasks()
10  0x436ee0b8a WebCore::FrameViewLayoutContext::runAsynchronousTasks()
11  0x436ee2120 WebCore::FrameViewLayoutContext::runOrScheduleAsynchronousTasks()
12  0x436ee1865 WebCore::FrameViewLayoutContext::layout()
13  0x436e7706b WebCore::FrameView::updateLayoutAndStyleIfNeededRecursive()
14  0x436f131ac WebCore::Page::layoutIfNeeded()
15  0x3ef56fcb1 WebKit::WebPage::layoutIfNeeded()
16  0x3ee83f3c5 WebKit::WebPage::focusedElementInformation()
17  0x3ef581d9c WebKit::WebPage::elementDidFocus(WebCore::Element&, WebCore::FocusOptions const&)
18  0x3ef23d2f9 WebKit::WebChromeClient::elementDidFocus(WebCore::Element&, WebCore::FocusOptions const&)
19  0x436084f0d WebCore::Element::dispatchFocusEvent(WTF::RefPtr<WebCore::Element, WTF::RawPtrTraits<WebCore::Element>, WTF::DefaultRefDerefTraits<WebCore::Element> >&&, WebCore::FocusOptions const&)
20  0x435fa3150 WebCore::Document::setFocusedElement(WebCore::Element*, WebCore::FocusOptions const&)
21  0x436e7ff63 WebCore::FocusController::setFocusedElement(WebCore::Element*, WebCore::Frame&, WebCore::FocusOptions const&)
22  0x4362f2724 WebCore::FrameSelection::setFocusedElementIfNeeded()
23  0x4362f2104 WebCore::FrameSelection::setSelectionWithoutUpdatingAppearance(WebCore::VisibleSelection const&, WTF::OptionSet<WebCore::FrameSelection::SetSelectionOption>, WebCore::FrameSelection::CursorAlignOnScroll, WebCore::TextGranularity)
24  0x4362d5050 WebCore::FrameSelection::setSelection(WebCore::VisibleSelection const&, WTF::OptionSet<WebCore::FrameSelection::SetSelectionOption>, WebCore::AXTextStateChangeIntent, WebCore::FrameSelection::CursorAlignOnScroll, WebCore::TextGranularity)
25  0x4362f06c3 WebCore::FrameSelection::moveTo(WebCore::Position const&, WebCore::Position const&, WebCore::Affinity, WebCore::EUserTriggered)
26  0x436e10147 WebCore::DOMSelection::setBaseAndExtent(WebCore::Node*, unsigned int, WebCore::Node*, unsigned int)
27  0x433479c81 WebCore::jsDOMSelectionPrototypeFunction_setBaseAndExtentBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSDOMSelection*)::'lambda'()::operator()() const
28  0x4334797a1 JSC::JSValue WebCore::toJS<WebCore::IDLUndefined, WebCore::jsDOMSelectionPrototypeFunction_setBaseAndExtentBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSDOMSelection*)::'lambda'()>(JSC::JSGlobalObject&, JSC::ThrowScope&, WebCore::jsDOMSelectionPrototypeFunction_setBaseAndExtentBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSDOMSelection*)::'lambda'()&&)
29  0x433479673 WebCore::jsDOMSelectionPrototypeFunction_setBaseAndExtentBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSDOMSelection*)
30  0x433478efd long long WebCore::IDLOperation<WebCore::JSDOMSelection>::call<&(WebCore::jsDOMSelectionPrototypeFunction_setBaseAndExtentBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSDOMSelection*)), (WebCore::CastedThisErrorBehavior)0>(JSC::JSGlobalObject&, JSC::CallFrame&, char const*)
31  0x433473954 WebCore::jsDOMSelectionPrototypeFunction_setBaseAndExtent(JSC::JSGlobalObject*, JSC::CallFrame*)
com.apple.WebKit.WebContent.Development terminated (pid 60804) because the process crashed

https://build.webkit.org/results/Apple-iOS-15-Simulator-Debug-WK2-Tests/r291742%20(2039)/results.html