Bug 13493 - REGRESSION: Crash at WTF::fastFree() when arrowing backward through editable text
Summary: REGRESSION: Crash at WTF::fastFree() when arrowing backward through editable ...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: HTML Editing (show other bugs)
Version: 523.x (Safari 3)
Hardware: Mac OS X 10.4
: P1 Normal
Assignee: Nobody
URL:
Keywords: InRadar, Regression
Depends on:
Blocks:
 
Reported: 2007-04-25 15:10 PDT by Justin Garcia
Modified: 2007-04-30 13:05 PDT (History)
0 users

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Justin Garcia 2007-04-25 15:10:40 PDT 
Open:
<body contenteditable="true">&#149; <b>This is some linked text</b></body>
Place the caret at the end of the document and left arrow backward through the text.  Crash occurs when the caret is between 'm' and 'e' of 'some'.

0   com.apple.JavaScriptCore 	0x001747ca WTF::fastFree(void*) + 58
1   com.apple.WebCore        	0x0118b900 WebCore::DeprecatedStringData::~DeprecatedStringData [in-charge]() + 32
2   com.apple.WebCore        	0x011d28dd WebCore::previousBoundary(WebCore::VisiblePosition const&, unsigned (*)(unsigned short const*, unsigned)) + 893
3   com.apple.WebCore        	0x011d5be0 WebCore::startOfWord(WebCore::VisiblePosition const&, WebCore::EWordSide) + 256
4   com.apple.WebCore        	0x010abba6 WebCore::Frame::respondToChangedSelection(WebCore::Selection const&, bool) + 310
5   com.apple.WebCore        	0x011c669f WebCore::SelectionController::setSelection(WebCore::Selection const&, bool, bool, bool) + 895
6   com.apple.WebCore        	0x011c8326 WebCore::SelectionController::moveTo(WebCore::VisiblePosition const&, bool) + 118
7   com.apple.WebCore        	0x011c947d WebCore::SelectionController::modify(WebCore::SelectionController::EAlteration, WebCore::SelectionController::EDirection, WebCore::TextGranularity, bool) + 509

...

<rdar://problem/5157329> REGRESSION: Crash at WTF::fastFree() when arrowing backward through editable text
Comment 1 Justin Garcia 2007-04-27 15:15:16 PDT 
Regressed between r20814 and r20836.
Comment 2 Justin Garcia 2007-04-28 19:55:25 PDT 
Looks like r20819 caused this.
Comment 3 Justin Garcia 2007-04-30 13:05:15 PDT 
I backed out those changes in r21193.  We'll revisit the bug fixed by those changes later.