137961 2014-10-22 08:37:09 -0700 Crash in WebCore::Node::getFlag 2014-11-10 08:20:50 -0800 1 1 1 Unclassified WebKit DOM 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 116980 1 rhodovan.u-szeged ossy commit-queue darin enrica koivisto ossy rniwa sam oldest_to_newest 1043452 0 240275 rhodovan.u-szeged 2014-10-22 08:37:09 -0700 Created attachment 240275 Test case The crashing test: <!DOCTYPE html> <html contenteditable> <head> <script> function test() { document.execCommand("selectAll", false, null); document.execCommand("createlink", true, "http://www.example.com"); document.execCommand("removeFormat", false, null); } </script> <style> * { display:table-row-group; } </style> </head> <body onload='test()' hidden> Backtrace: Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7fff98c1f700 (LWP 22759)] 0x00007ffff2771463 in WebCore::Node::getFlag (this=0x0, mask=WebCore::Node::IsTextFlag) at ../../Source/WebCore/dom/Node.h:630 630 bool getFlag(NodeFlags mask) const { return m_nodeFlags & mask; } #0 0x00007ffff2771463 in WebCore::Node::getFlag (this=0x0, mask=WebCore::Node::IsTextFlag) at ../../Source/WebCore/dom/Node.h:630 #1 0x00007ffff291d1d7 in WebCore::Node::isTextNode (this=0x0) at ../../Source/WebCore/dom/Node.h:228 #2 0x00007ffff291d423 in WebCore::firstPositionInNode (anchorNode=0x0) at ../../Source/WebCore/dom/Position.h:306 #3 0x00007ffff3149f87 in WebCore::ApplyStyleCommand::applyBlockStyle (this=0x8ff570, style=0x675f90) at ../../Source/WebCore/editing/ApplyStyleCommand.cpp:260 #4 0x00007ffff3149c59 in WebCore::ApplyStyleCommand::doApply (this=0x8ff570) at ../../Source/WebCore/editing/ApplyStyleCommand.cpp:214 #5 0x00007ffff315c47a in WebCore::CompositeEditCommand::applyCommandToComposite (this=0x804720, prpCommand=...) at ../../Source/WebCore/editing/CompositeEditCommand.cpp:277 #6 0x00007ffff31cb7b8 in WebCore::RemoveFormatCommand::doApply (this=0x804720) at ../../Source/WebCore/editing/RemoveFormatCommand.cpp:93 #7 0x00007ffff315c1e1 in WebCore::CompositeEditCommand::apply (this=0x804720) at ../../Source/WebCore/editing/CompositeEditCommand.cpp:226 #8 0x00007ffff315bf97 in WebCore::applyCommand (command=...) at ../../Source/WebCore/editing/CompositeEditCommand.cpp:183 #9 0x00007ffff31888e4 in WebCore::Editor::removeFormattingAndStyle (this=0x8c33c0) at ../../Source/WebCore/editing/Editor.cpp:891 #10 0x00007ffff31a1162 in WebCore::executeRemoveFormat (frame=...) at ../../Source/WebCore/editing/EditorCommand.cpp:983 #11 0x00007ffff31a2fd9 in WebCore::Editor::Command::execute (this=0x7fffffffc6a0, parameter=..., triggeringEvent=0x0) at ../../Source/WebCore/editing/EditorCommand.cpp:1726 #12 0x00007ffff30343f8 in WebCore::Document::execCommand (this=0xa7da90, commandName=..., userInterface=false, value=...) at ../../Source/WebCore/dom/Document.cpp:4373 #13 0x00007ffff402b8cd in WebCore::jsDocumentPrototypeFunctionExecCommand (exec=0x7fffffffc7a0) at DerivedSources/WebCore/JSDocument.cpp:4526 #14 0x00007fff9a8f40b4 in ?? () #15 0x00007fffffffc800 in ?? () #16 0x00007fffeda92edb in llint_entry () from /home/reni/data/REPOS/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18 1043653 1 darin 2014-10-22 20:02:27 -0700 The fix for this is in ApplyStyleCommand::applyBlockStyle: if (!scope) return; This needs to be done just after scope is initialized. 1047058 2 241172 ossy 2014-11-07 04:49:44 -0800 Created attachment 241172 WIP patch seems working locally, WIP patch for EWS 1047519 3 241285 ossy 2014-11-10 04:44:22 -0800 Created attachment 241285 Patch 1047538 4 241285 commit-queue 2014-11-10 08:20:46 -0800 Comment on attachment 241285 Patch Clearing flags on attachment: 241285 Committed r175809: <http://trac.webkit.org/changeset/175809> 1047539 5 commit-queue 2014-11-10 08:20:50 -0800 All reviewed patches have been landed. Closing bug. 240275 2014-10-22 08:37:09 -0700 2014-10-22 08:37:09 -0700 Test case crash.html text/html 353 rhodovan.u-szeged PCFET0NUWVBFIGh0bWw+CjxodG1sIGNvbnRlbnRlZGl0YWJsZT4KPGhlYWQ+CjxzY3JpcHQ+CmZ1 bmN0aW9uIHRlc3QoKSB7CiAgICBkb2N1bWVudC5leGVjQ29tbWFuZCgic2VsZWN0QWxsIiwgZmFs c2UsIG51bGwpOwogICAgZG9jdW1lbnQuZXhlY0NvbW1hbmQoImNyZWF0ZWxpbmsiLCB0cnVlLCAi aHR0cDovL3d3dy5leGFtcGxlLmNvbSIpOwogICAgZG9jdW1lbnQuZXhlY0NvbW1hbmQoInJlbW92 ZUZvcm1hdCIsIGZhbHNlLCBudWxsKTsKfQo8L3NjcmlwdD4KPHN0eWxlPgoqIHsKICAgIGRpc3Bs YXk6dGFibGUtcm93LWdyb3VwOwp9Cjwvc3R5bGU+CjwvaGVhZD4KPGJvZHkgb25sb2FkPSd0ZXN0 KCknIGhpZGRlbj4= 241172 2014-11-07 04:49:44 -0800 2014-11-10 04:44:17 -0800 WIP patch bug-137961-20141107134954.patch text/plain 1653 ossy U3VidmVyc2lvbiBSZXZpc2lvbjogMTc1NzQ1CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMzI5ZmM3NDE4MmViMzU2 OWYzYjJkYjQ1OTE4ZDc0ZmI1ZDljNGZkNy4uZDZkOGE2YjgxMzNmM2FlZmI1YThlM2MxYjZiZThh NDAzZTkwMjdjZCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDExIEBACisyMDE0LTExLTA3ICBDc2Fi YSBPc3p0cm9nb27DoWMgIDxvc3N5QHdlYmtpdC5vcmc+CisKKyAgICAgICAgQ3Jhc2ggaW4gV2Vi Q29yZTo6Tm9kZTo6Z2V0RmxhZworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93 X2J1Zy5jZ2k/aWQ9MTM3OTYxCisKKyAgICAgICAgKiBlZGl0aW5nL0FwcGx5U3R5bGVDb21tYW5k LmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkFwcGx5U3R5bGVDb21tYW5kOjphcHBseUJsb2NrU3R5 bGUpOgorCiAyMDE0LTExLTA2ICBDYXJsb3MgR2FyY2lhIENhbXBvcyAgPGNnYXJjaWFAaWdhbGlh LmNvbT4KIAogICAgICAgICBVbnJldmlld2VkLiBUcnkgdG8gZml4IEdUSyBidWlsZCBhZnRlciBy MTc1NzE5LgpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvZWRpdGluZy9BcHBseVN0eWxlQ29t bWFuZC5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9lZGl0aW5nL0FwcGx5U3R5bGVDb21tYW5kLmNwcApp bmRleCA3ODU3ZmQ5MTljM2FlNDdiODQ2ZDUxOTEzNTVmOGJmNmVhOGI0NTI4Li41YzFiZjUwMzZm NTEwZTJhYjQ3NmEzMGRjZThhMGMxOGIwYTlhNjQ2IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29y ZS9lZGl0aW5nL0FwcGx5U3R5bGVDb21tYW5kLmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9lZGl0 aW5nL0FwcGx5U3R5bGVDb21tYW5kLmNwcApAQCAtMjU3LDYgKzI1Nyw5IEBAIHZvaWQgQXBwbHlT dHlsZUNvbW1hbmQ6OmFwcGx5QmxvY2tTdHlsZShFZGl0aW5nU3R5bGUgKnN0eWxlKQogICAgIC8v IGFkZEJsb2NrU3R5bGVJZk5lZWRlZCBtYXkgbW92ZVBhcmFncmFwaHMsIHdoaWNoIGNhbiByZW1v dmUgdGhlc2UgZW5kcG9pbnRzLgogICAgIC8vIENhbGN1bGF0ZSBzdGFydCBhbmQgZW5kIGluZGlj ZXMgZnJvbSB0aGUgc3RhcnQgb2YgdGhlIHRyZWUgdGhhdCB0aGV5J3JlIGluLgogICAgIE5vZGUq IHNjb3BlID0gaGlnaGVzdEVkaXRhYmxlUm9vdCh2aXNpYmxlU3RhcnQuZGVlcEVxdWl2YWxlbnQo KSk7CisgICAgaWYgKCFzY29wZSkKKyAgICAgICAgcmV0dXJuOworCiAgICAgUmVmUHRyPFJhbmdl PiBzdGFydFJhbmdlID0gUmFuZ2U6OmNyZWF0ZShkb2N1bWVudCgpLCBmaXJzdFBvc2l0aW9uSW5O b2RlKHNjb3BlKSwgdmlzaWJsZVN0YXJ0LmRlZXBFcXVpdmFsZW50KCkucGFyZW50QW5jaG9yZWRF cXVpdmFsZW50KCkpOwogICAgIFJlZlB0cjxSYW5nZT4gZW5kUmFuZ2UgPSBSYW5nZTo6Y3JlYXRl KGRvY3VtZW50KCksIGZpcnN0UG9zaXRpb25Jbk5vZGUoc2NvcGUpLCB2aXNpYmxlRW5kLmRlZXBF cXVpdmFsZW50KCkucGFyZW50QW5jaG9yZWRFcXVpdmFsZW50KCkpOwogICAgIGludCBzdGFydElu ZGV4ID0gVGV4dEl0ZXJhdG9yOjpyYW5nZUxlbmd0aChzdGFydFJhbmdlLmdldCgpLCB0cnVlKTsK 241285 2014-11-10 04:44:22 -0800 2014-11-10 08:20:46 -0800 Patch bug-137961-20141110134423.patch text/plain 3813 ossy U3VidmVyc2lvbiBSZXZpc2lvbjogMTc1NzQ1CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMzI5ZmM3NDE4MmViMzU2 OWYzYjJkYjQ1OTE4ZDc0ZmI1ZDljNGZkNy4uYmMwZDMxODc5YmU1OGIyMTJhZmFmNjE1OGU3MzFh OWMxYTA2YjViNiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDEzIEBACisyMDE0LTExLTA3ICBDc2Fi YSBPc3p0cm9nb27DoWMgIDxvc3N5QHdlYmtpdC5vcmc+CisKKyAgICAgICAgQ3Jhc2ggaW4gV2Vi Q29yZTo6Tm9kZTo6Z2V0RmxhZworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93 X2J1Zy5jZ2k/aWQ9MTM3OTYxCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISku CisKKyAgICAgICAgKiBlZGl0aW5nL0FwcGx5U3R5bGVDb21tYW5kLmNwcDoKKyAgICAgICAgKFdl YkNvcmU6OkFwcGx5U3R5bGVDb21tYW5kOjphcHBseUJsb2NrU3R5bGUpOiBOdWxsIHBvaW50ZXIg Y2hlY2sgYWRkZWQuCisKIDIwMTQtMTEtMDYgIENhcmxvcyBHYXJjaWEgQ2FtcG9zICA8Y2dhcmNp YUBpZ2FsaWEuY29tPgogCiAgICAgICAgIFVucmV2aWV3ZWQuIFRyeSB0byBmaXggR1RLIGJ1aWxk IGFmdGVyIHIxNzU3MTkuCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9lZGl0aW5nL0FwcGx5 U3R5bGVDb21tYW5kLmNwcCBiL1NvdXJjZS9XZWJDb3JlL2VkaXRpbmcvQXBwbHlTdHlsZUNvbW1h bmQuY3BwCmluZGV4IDc4NTdmZDkxOWMzYWU0N2I4NDZkNTE5MTM1NWY4YmY2ZWE4YjQ1MjguLjVj MWJmNTAzNmY1MTBlMmFiNDc2YTMwZGNlOGEwYzE4YjBhOWE2NDYgMTAwNjQ0Ci0tLSBhL1NvdXJj ZS9XZWJDb3JlL2VkaXRpbmcvQXBwbHlTdHlsZUNvbW1hbmQuY3BwCisrKyBiL1NvdXJjZS9XZWJD b3JlL2VkaXRpbmcvQXBwbHlTdHlsZUNvbW1hbmQuY3BwCkBAIC0yNTcsNiArMjU3LDkgQEAgdm9p ZCBBcHBseVN0eWxlQ29tbWFuZDo6YXBwbHlCbG9ja1N0eWxlKEVkaXRpbmdTdHlsZSAqc3R5bGUp CiAgICAgLy8gYWRkQmxvY2tTdHlsZUlmTmVlZGVkIG1heSBtb3ZlUGFyYWdyYXBocywgd2hpY2gg Y2FuIHJlbW92ZSB0aGVzZSBlbmRwb2ludHMuCiAgICAgLy8gQ2FsY3VsYXRlIHN0YXJ0IGFuZCBl bmQgaW5kaWNlcyBmcm9tIHRoZSBzdGFydCBvZiB0aGUgdHJlZSB0aGF0IHRoZXkncmUgaW4uCiAg ICAgTm9kZSogc2NvcGUgPSBoaWdoZXN0RWRpdGFibGVSb290KHZpc2libGVTdGFydC5kZWVwRXF1 aXZhbGVudCgpKTsKKyAgICBpZiAoIXNjb3BlKQorICAgICAgICByZXR1cm47CisKICAgICBSZWZQ dHI8UmFuZ2U+IHN0YXJ0UmFuZ2UgPSBSYW5nZTo6Y3JlYXRlKGRvY3VtZW50KCksIGZpcnN0UG9z aXRpb25Jbk5vZGUoc2NvcGUpLCB2aXNpYmxlU3RhcnQuZGVlcEVxdWl2YWxlbnQoKS5wYXJlbnRB bmNob3JlZEVxdWl2YWxlbnQoKSk7CiAgICAgUmVmUHRyPFJhbmdlPiBlbmRSYW5nZSA9IFJhbmdl OjpjcmVhdGUoZG9jdW1lbnQoKSwgZmlyc3RQb3NpdGlvbkluTm9kZShzY29wZSksIHZpc2libGVF bmQuZGVlcEVxdWl2YWxlbnQoKS5wYXJlbnRBbmNob3JlZEVxdWl2YWxlbnQoKSk7CiAgICAgaW50 IHN0YXJ0SW5kZXggPSBUZXh0SXRlcmF0b3I6OnJhbmdlTGVuZ3RoKHN0YXJ0UmFuZ2UuZ2V0KCks IHRydWUpOwpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nIGIvTGF5b3V0VGVzdHMv Q2hhbmdlTG9nCmluZGV4IGY0YTczNjlhNTNjMmYxZTY4ZTkyYTg3ZDc4NzQzZWU5NzhkMzUwOGQu LmIwM2MwOWFjMzFiZTczNjk2ZDgwYTkwZWY0OWExNzcxNDg4OTlhYTQgMTAwNjQ0Ci0tLSBhL0xh eW91dFRlc3RzL0NoYW5nZUxvZworKysgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKQEAgLTEsMyAr MSwxMyBAQAorMjAxNC0xMS0xMCAgQ3NhYmEgT3N6dHJvZ29uw6FjICA8b3NzeUB3ZWJraXQub3Jn PgorCisgICAgICAgIENyYXNoIGluIFdlYkNvcmU6Ok5vZGU6OmdldEZsYWcKKyAgICAgICAgaHR0 cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEzNzk2MQorCisgICAgICAgIFJl dmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogZWRpdGluZy9leGVjQ29tbWFu ZC9jcmFzaC0xMzc5NjEtZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiBlZGl0aW5nL2V4 ZWNDb21tYW5kL2NyYXNoLTEzNzk2MS5odG1sOiBBZGRlZC4KKwogMjAxNC0xMS0wNyAgTWFyayBM YW0gIDxtYXJrLmxhbUBhcHBsZS5jb20+CiAKICAgICAgICAgR2FyZGVuaW5nOiBnZXQtYnktcG5h bWUuanMgaXMgZmFpbGluZyB3aGVuIHJ1biB3aXRoIEpTQ191c2VMTElOVD1mYWxzZSBhbmQgb3Ro ZXIgc3BlY2lhbCBKSVQgY29uZmlndXJhdGlvbnMuCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9l ZGl0aW5nL2V4ZWNDb21tYW5kL2NyYXNoLTEzNzk2MS1leHBlY3RlZC50eHQgYi9MYXlvdXRUZXN0 cy9lZGl0aW5nL2V4ZWNDb21tYW5kL2NyYXNoLTEzNzk2MS1leHBlY3RlZC50eHQKbmV3IGZpbGUg bW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MC4uOGNlMmY0Y2Y0YmIyMzNmNzhiZDZiY2IzMGVmZjUxNDU1MDJkNzZlNwotLS0gL2Rldi9udWxs CisrKyBiL0xheW91dFRlc3RzL2VkaXRpbmcvZXhlY0NvbW1hbmQvY3Jhc2gtMTM3OTYxLWV4cGVj dGVkLnR4dApAQCAtMCwwICsxLDMgQEAKK1Rlc3QgZm9yIGJ1ZyBDcmFzaCBpbiBXZWJDb3JlOjpO b2RlOjpnZXRGbGFnCisKK1RoaXMgdGVzdCBwYXNzZXMgaWYgaXQgZG9lc24ndCBjcmFzaC4KZGlm ZiAtLWdpdCBhL0xheW91dFRlc3RzL2VkaXRpbmcvZXhlY0NvbW1hbmQvY3Jhc2gtMTM3OTYxLmh0 bWwgYi9MYXlvdXRUZXN0cy9lZGl0aW5nL2V4ZWNDb21tYW5kL2NyYXNoLTEzNzk2MS5odG1sCm5l dyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAuLjZlYTVjMjBjYTE4MTEzN2FiOThlNTUyODU2Yzk2ZjBkNDMzYWM5NzUKLS0tIC9k ZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9lZGl0aW5nL2V4ZWNDb21tYW5kL2NyYXNoLTEzNzk2 MS5odG1sCkBAIC0wLDAgKzEsMjQgQEAKKzwhRE9DVFlQRSBodG1sPgorPGh0bWwgY29udGVudGVk aXRhYmxlPgorPGhlYWQ+Cis8c2NyaXB0PgoraWYgKHdpbmRvdy50ZXN0UnVubmVyKQorICAgIHRl c3RSdW5uZXIuZHVtcEFzVGV4dCgpOworCitmdW5jdGlvbiB0ZXN0KCkgeworICAgIGRvY3VtZW50 LmV4ZWNDb21tYW5kKCJzZWxlY3RBbGwiLCBmYWxzZSwgbnVsbCk7CisgICAgZG9jdW1lbnQuZXhl Y0NvbW1hbmQoImNyZWF0ZWxpbmsiLCB0cnVlLCAiaHR0cDovL3d3dy5leGFtcGxlLmNvbSIpOwor ICAgIGRvY3VtZW50LmV4ZWNDb21tYW5kKCJyZW1vdmVGb3JtYXQiLCBmYWxzZSwgbnVsbCk7Cisg ICAgZG9jdW1lbnQud3JpdGUoIjxwPlRlc3QgZm9yIGJ1ZyA8YSBocmVmPVwiaHR0cHM6Ly9idWdz LndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEzNzk2MVwiPkNyYXNoIGluIFdlYkNvcmU6Ok5v ZGU6OmdldEZsYWc8L2E+PC9wPiIpOworICAgIGRvY3VtZW50LndyaXRlKCI8cD5UaGlzIHRlc3Qg cGFzc2VzIGlmIGl0IGRvZXNuJ3QgY3Jhc2guPC9wPiIpOworfQorPC9zY3JpcHQ+Cis8c3R5bGU+ CisqIHsKKyAgICBkaXNwbGF5OnRhYmxlLXJvdy1ncm91cDsKK30KKzwvc3R5bGU+Cis8L2hlYWQ+ Cis8Ym9keSBvbmxvYWQ9J3Rlc3QoKTsnIGhpZGRlbj4KKzwvYm9keT4KKzwvaHRtbD4K