<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>19090</bug_id>
          
          <creation_ts>2008-05-15 15:15:49 -0700</creation_ts>
          <short_desc>Crash in editing code in ReplaceSelectionCommand::doApply()</short_desc>
          <delta_ts>2008-06-27 09:43:32 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>HTML Editing</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>Mac</rep_platform>
          <op_sys>OS X 10.5</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>WORKSFORME</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P1</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          <blocked>18858</blocked>
          <everconfirmed>1</everconfirmed>
          <reporter name="Eric Seidel (no email)">eric</reporter>
          <assigned_to name="Nobody">webkit-unassigned</assigned_to>
          <cc>justin.garcia</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>80562</commentid>
    <comment_count>0</comment_count>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2008-05-15 15:15:49 -0700</bug_when>
    <thetext>Crash in editing code in ReplaceSelectionCommand::doApply()

Yet another crash in editing code found by the fuzzer.

  doc.execCommand(&apos;formatblock&apos;, 1, &apos;&lt;pre&gt;&apos;);
  doc.execCommand(&apos;inserthorizontalrule&apos;);
  doc.execCommand(&apos;indent&apos;);
  doc.execCommand(&apos;inserthorizontalrule&apos;);
  doc.execCommand(&apos;justifyright&apos;);
  doc.execCommand(&apos;outdent&apos;);
  doc.execCommand(&apos;insertparagraph&apos;);
  doc.execCommand(&apos;outdent&apos;);
  doc.execCommand(&apos;selectall&apos;);
  doc.execCommand(&apos;inserthorizontalrule&apos;);

See test case.  Crashes both release and debug.
Process:         Safari [46969]
Path:            /Applications/Safari.app/Contents/MacOS/Safari
Identifier:      com.apple.Safari
Version:         3.1.1 (5525.18)
Build Info:      WebBrowser-55251800~2
Code Type:       X86 (Native)
Parent Process:  perl [46966]

Date/Time:       2008-05-15 15:12:50.612 -0700
OS Version:      Mac OS X 10.5.2 (9C7010)
Report Version:  6

Exception Type:  EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_PROTECTION_FAILURE at 0x0000000000000000
Crashed Thread:  0

Thread 0 Crashed:
0   com.apple.WebCore             	0x01401f77 WebCore::ReplaceSelectionCommand::doApply() + 983 (Node.h:94)
1   com.apple.WebCore             	0x0111ec9d WebCore::EditCommand::apply() + 61 (EditCommand.cpp:96)
2   com.apple.WebCore             	0x0112d005 WebCore::executeInsertFragment(WebCore::Frame*, WTF::PassRefPtr&lt;WebCore::DocumentFragment&gt;) + 133 (PassRefPtr.h:44)
3   com.apple.WebCore             	0x0112d20e WebCore::executeInsertNode(WebCore::Frame*, WTF::PassRefPtr&lt;WebCore::Node&gt;) + 206 (PassRefPtr.h:44)
4   com.apple.WebCore             	0x0112d37a WebCore::executeInsertHorizontalRule(WebCore::Frame*, WebCore::Event*, WebCore::EditorCommandSource, WebCore::String const&amp;) + 106 (PassRefPtr.h:44)
5   com.apple.WebCore             	0x0112b322 WebCore::Editor::Command::execute(WebCore::String const&amp;, WebCore::Event*) const + 82 (EditorCommand.cpp:1364)
6   com.apple.WebCore             	0x010fa875 WebCore::Document::execCommand(WebCore::String const&amp;, bool, WebCore::String const&amp;) + 53 (RefPtr.h:51)
7   com.apple.WebCore             	0x0125ce1f WebCore::jsDocumentPrototypeFunctionExecCommand(KJS::ExecState*, KJS::JSObject*, KJS::List const&amp;) + 271 (RefPtr.h:51)
8   com.apple.JavaScriptCore      	0x003b49d9 KJS::FunctionCallDotNode::evaluate(KJS::ExecState*) + 697 (object.cpp:107)
9   com.apple.JavaScriptCore      	0x0039bd29 KJS::ExprStatementNode::execute(KJS::ExecState*) + 25 (nodes.cpp:3994)
10  com.apple.JavaScriptCore      	0x003dd121 KJS::FunctionBodyNode::execute(KJS::ExecState*) + 481 (nodes.cpp:3949)
11  com.apple.JavaScriptCore      	0x003d9965 KJS::FunctionImp::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&amp;) + 405 (function.cpp:78)
12  com.apple.JavaScriptCore      	0x0038d917 KJS::JSObject::call(KJS::ExecState*, KJS::JSObject*, KJS::List const&amp;) + 135 (object.cpp:107)
13  com.apple.WebCore             	0x01551f8c WebCore::JSAbstractEventListener::handleEvent(WebCore::Event*, bool) + 1420 (kjs_events.cpp:100)
14  com.apple.WebCore             	0x0113fe46 WebCore::EventTarget::handleLocalEvents(WebCore::EventTargetNode*, WebCore::Event*, bool) + 182 (EventTarget.cpp:314)
15  com.apple.WebCore             	0x011408af WebCore::EventTargetNode::handleLocalEvents(WebCore::Event*, bool) + 79 (EventTargetNode.cpp:106)
16  com.apple.WebCore             	0x0113ff7d WebCore::EventTarget::dispatchGenericEvent(WebCore::EventTargetNode*, WTF::PassRefPtr&lt;WebCore::Event&gt;, int&amp;, bool) + 301 (DeprecatedPtrList.h:105)
17  com.apple.WebCore             	0x011414ef WebCore::EventTargetNode::dispatchEvent(WTF::PassRefPtr&lt;WebCore::Event&gt;, int&amp;, bool) + 255 (PassRefPtr.h:44)
18  com.apple.WebCore             	0x01141aca WebCore::EventTargetNode::dispatchMouseEvent(WebCore::AtomicString const&amp;, int, int, int, int, int, int, bool, bool, bool, bool, bool, WebCore::Node*, WTF::PassRefPtr&lt;WebCore::Event&gt;) + 506 (PassRefPtr.h:44)
19  com.apple.WebCore             	0x01142215 WebCore::EventTargetNode::dispatchMouseEvent(WebCore::PlatformMouseEvent const&amp;, WebCore::AtomicString const&amp;, int, WebCore::Node*) + 165 (PassRefPtr.h:44)
20  com.apple.WebCore             	0x01138325 WebCore::EventHandler::dispatchMouseEvent(WebCore::AtomicString const&amp;, WebCore::Node*, bool, int, WebCore::PlatformMouseEvent const&amp;, bool) + 101 (EventHandler.cpp:1278)
21  com.apple.WebCore             	0x01138832 WebCore::EventHandler::handleMouseReleaseEvent(WebCore::PlatformMouseEvent const&amp;) + 722 (EventHandler.cpp:1098)
22  com.apple.WebCore             	0x0113f349 WebCore::EventHandler::mouseUp(NSEvent*) + 393 (EventHandlerMac.mm:540)
23  com.apple.WebKit              	0x001b93bc -[WebHTMLView mouseUp:] + 220 (WebHTMLView.mm:3215)
24  com.apple.WebCore             	0x0113e16e WebCore::EventHandler::passSubframeEventToSubframe(WebCore::MouseEventWithHitTestResults&amp;, WebCore::Frame*, WebCore::HitTestResult*) + 558 (EventHandlerMac.mm:437)
25  com.apple.WebCore             	0x0113e267 WebCore::EventHandler::passMouseReleaseEventToSubframe(WebCore::MouseEventWithHitTestResults&amp;, WebCore::Frame*) + 39 (EventHandlerMac.mm:644)
26  com.apple.WebCore             	0x0113871f WebCore::EventHandler::handleMouseReleaseEvent(WebCore::PlatformMouseEvent const&amp;) + 447 (EventHandler.cpp:1088)
27  com.apple.WebCore             	0x0113f349 WebCore::EventHandler::mouseUp(NSEvent*) + 393 (EventHandlerMac.mm:540)
28  com.apple.WebKit              	0x001b93bc -[WebHTMLView mouseUp:] + 220 (WebHTMLView.mm:3215)
29  com.apple.AppKit              	0x90d0db61 -[NSWindow sendEvent:] + 5539
30  com.apple.Safari              	0x0002b3c3 0x1000 + 172995
31  com.apple.AppKit              	0x90cda714 -[NSApplication sendEvent:] + 2780
32  com.apple.Safari              	0x0002ae48 0x1000 + 171592
33  com.apple.AppKit              	0x90c380f9 -[NSApplication run] + 847
34  com.apple.AppKit              	0x90c0530a NSApplicationMain + 574
35  com.apple.Safari              	0x000b9906 0x1000 + 755974

Thread 1:
0   libSystem.B.dylib             	0x900d6bce __semwait_signal + 10
1   libSystem.B.dylib             	0x901018cd pthread_cond_wait$UNIX2003 + 73
2   com.apple.WebCore             	0x011ffb9f WebCore::IconDatabase::syncThreadMainLoop() + 239 (IconDatabase.cpp:1313)
3   com.apple.WebCore             	0x011ffcb5 WebCore::IconDatabase::iconDatabaseSyncThread() + 181 (IconDatabase.cpp:1015)
4   libSystem.B.dylib             	0x90100c55 _pthread_start + 321
5   libSystem.B.dylib             	0x90100b12 thread_start + 34

Thread 2:
0   libSystem.B.dylib             	0x900d6bce __semwait_signal + 10
1   libSystem.B.dylib             	0x901018cd pthread_cond_wait$UNIX2003 + 73
2   com.apple.WebCore             	0x015eeccb WebCore::LocalStorageThread::localStorageThread() + 427 (MessageQueue.h:79)
3   libSystem.B.dylib             	0x90100c55 _pthread_start + 321
4   libSystem.B.dylib             	0x90100b12 thread_start + 34

Thread 3:
0   libSystem.B.dylib             	0x900cf9e6 mach_msg_trap + 10
1   libSystem.B.dylib             	0x900d71dc mach_msg + 72
2   com.apple.CoreFoundation      	0x90b250de CFRunLoopRunSpecific + 1806
3   com.apple.CoreFoundation      	0x90b25d18 CFRunLoopRunInMode + 88
4   com.apple.CFNetwork           	0x905926cc CFURLCacheWorkerThread(void*) + 396
5   libSystem.B.dylib             	0x90100c55 _pthread_start + 321
6   libSystem.B.dylib             	0x90100b12 thread_start + 34

Thread 4:
0   libSystem.B.dylib             	0x900cf9e6 mach_msg_trap + 10
1   libSystem.B.dylib             	0x900d71dc mach_msg + 72
2   com.apple.CoreFoundation      	0x90b250de CFRunLoopRunSpecific + 1806
3   com.apple.CoreFoundation      	0x90b25d18 CFRunLoopRunInMode + 88
4   com.apple.Foundation          	0x94c8cac0 +[NSURLConnection(NSURLConnectionReallyInternal) _resourceLoadLoop:] + 320
5   com.apple.Foundation          	0x94c295ad -[NSThread main] + 45
6   com.apple.Foundation          	0x94c29154 __NSThread__main__ + 308
7   libSystem.B.dylib             	0x90100c55 _pthread_start + 321
8   libSystem.B.dylib             	0x90100b12 thread_start + 34

Thread 0 crashed with X86 Thread State (32-bit):
  eax: 0x01784524  ebx: 0x01401bb7  ecx: 0xbfffe14c  edx: 0x00000000
  edi: 0x00000000  esi: 0x00000000  ebp: 0xbfffe238  esp: 0xbfffde74
   ss: 0x0000001f  efl: 0x00010246  eip: 0x01401f77   cs: 0x00000017
   ds: 0x0000001f   es: 0x0000001f   fs: 0x00000000   gs: 0x00000037
  cr2: 0x00000000

Binary Images:
    0x1000 -   0x132fef  com.apple.Safari 3.1.1 (5525.18) &lt;7b337979f11e6e15dd50072420a92680&gt; /Applications/Safari.app/Contents/MacOS/Safari
  0x17a000 -   0x247fef  com.apple.WebKit 526.5+ (526.5+) &lt;472218e0c20375028b3fd1185479a9df&gt; /Users/eseidel/Projects/build/Release/WebKit.framework/Versions/A/WebKit
  0x33f000 -   0x34eff8  SyndicationUI ??? (???) &lt;d148012be42c8a6e21f9cc58739c8dc7&gt; /System/Library/PrivateFrameworks/SyndicationUI.framework/Versions/A/SyndicationUI
  0x35e000 -   0x423ff7  com.apple.JavaScriptCore 526.5+ (526.5+) &lt;720f9aef0ce2fe785de8c13937c2a878&gt; /Users/eseidel/Projects/build/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore
  0x4b6000 -   0x597ff7  libxml2.2.dylib ??? (???) &lt;3cd4cccd4ca35dffa4688436aa0cd908&gt; /usr/lib/libxml2.2.dylib
  0xfd9000 -  0x170bfff  com.apple.WebCore 526.5+ (526.5+) &lt;c9c42378ba06364b5790d456ac31284c&gt; /Users/eseidel/Projects/build/Release/WebCore.framework/Versions/A/WebCore
 0x1fb2000 -  0x20b3fef  com.apple.PubSub 1.0.3 (65.1) /System/Library/Frameworks/PubSub.framework/Versions/A/PubSub
 0x21bf000 -  0x21c4ff3  libCGXCoreImage.A.dylib ??? (???) &lt;978986709159e5fe9e094df5efddac1d&gt; /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources/libCGXCoreImage.A.dylib
 0x23f6000 -  0x24e4fef  com.apple.RawCamera.bundle 2.0.3 (2.0.3) /System/Library/CoreServices/RawCamera.bundle/Contents/MacOS/RawCamera
0x1874a000 - 0x1874ffff  com.apple.DictionaryServiceComponent 1.1 (1.1) &lt;8edc1180f52db18e9ddfb4e95debe61b&gt; /System/Library/Components/DictionaryService.component/Contents/MacOS/DictionaryService
0x187a0000 - 0x18811fff +com.DivXInc.DivXDecoder 6.4.0 (6.4.0) /Library/QuickTime/DivX Decoder.component/Contents/MacOS/DivX Decoder
0x8fe00000 - 0x8fe2da53  dyld 96.2 (???) &lt;7af47d3b00b2268947563c7fa8c59a07&gt; /usr/lib/dyld
0x90003000 - 0x90005ff5  libRadiance.dylib ??? (???) &lt;20eadb285da83df96c795c2c5fa20590&gt; /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libRadiance.dylib
0x90006000 - 0x9001cfff  com.apple.DictionaryServices 1.0.0 (1.0.0) &lt;ad0aa0252e3323d182e17f50defe56fc&gt; /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/DictionaryServices.framework/Versions/A/DictionaryServices
0x9001d000 - 0x90026fff  com.apple.speech.recognition.framework 3.7.24 (3.7.24) &lt;d3180f9edbd9a5e6f283d6156aa3c602&gt; /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/SpeechRecognition.framework/Versions/A/SpeechRecognition
0x90027000 - 0x900cefeb  com.apple.QD 3.11.52 (???) &lt;c72bd7bd2ce12694c3640a731d1ad878&gt; /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/QD.framework/Versions/A/QD
0x900cf000 - 0x9022eff3  libSystem.B.dylib ??? (???) &lt;4899376234e55593b22fc370935f8cdf&gt; /usr/lib/libSystem.B.dylib
0x902a4000 - 0x902a9fff  com.apple.backup.framework 1.0 (1.0) /System/Library/PrivateFrameworks/Backup.framework/Versions/A/Backup
0x902aa000 - 0x902aaffd  com.apple.Accelerate.vecLib 3.4.2 (vecLib 3.4.2) /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/vecLib
0x902ab000 - 0x9033efff  com.apple.ink.framework 101.3 (86) &lt;bf3fa8927b4b8baae92381a976fd2079&gt; /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Ink.framework/Versions/A/Ink
0x9033f000 - 0x90399ff7  com.apple.CoreText 2.0.1 (???) &lt;07494945ad1e3f5395599f42748457cc&gt; /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreText.framework/Versions/A/CoreText
0x9039a000 - 0x9039bffc  libffi.dylib ??? (???) &lt;a3b573eb950ca583290f7b2b4c486d09&gt; /usr/lib/libffi.dylib
0x9039c000 - 0x90423ff7  libsqlite3.0.dylib ??? (???) &lt;6978bbcca4277d6ae9f042beff643f7d&gt; /usr/lib/libsqlite3.0.dylib
0x90510000 - 0x90575ffb  com.apple.ISSupport 1.6 (34) /System/Library/PrivateFrameworks/ISSupport.framework/Versions/A/ISSupport
0x90582000 - 0x90586fff  libGIF.dylib ??? (???) &lt;d4234e6f5e5f530bdafb969157f1f17b&gt; /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libGIF.dylib
0x90587000 - 0x905fefe3  com.apple.CFNetwork 221.5 (221.5) &lt;5474cdd7d2a8b2e8059de249c702df9e&gt; /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CFNetwork.framework/Versions/A/CFNetwork
0x905ff000 - 0x9061effa  libJPEG.dylib ??? (???) &lt;0cfb80109d624beb9ceb3c43b6c5ec10&gt; /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libJPEG.dylib
0x9061f000 - 0x9069cfef  libvMisc.dylib ??? (???) /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libvMisc.dylib
0x9069d000 - 0x906c1feb  libssl.0.9.7.dylib ??? (???) &lt;acee7fc534674498dcac211318aa23e8&gt; /usr/lib/libssl.0.9.7.dylib
0x906c2000 - 0x9071bff7  libGLU.dylib ??? (???) /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLU.dylib
0x9071c000 - 0x90ab2ff7  com.apple.QuartzCore 1.5.1 (1.5.1) &lt;665c80f6e28555b303020c8007c36b8b&gt; /System/Library/Frameworks/QuartzCore.framework/Versions/A/QuartzCore
0x90ab3000 - 0x90be5fef  com.apple.CoreFoundation 6.5.1 (476.10) &lt;d5bed2688a5eea11a6dc3a3c5c17030e&gt; /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
0x90be6000 - 0x90bfefff  com.apple.openscripting 1.2.6 (???) &lt;b8e553df643f2aec68fa968b3b459b2b&gt; /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/OpenScripting.framework/Versions/A/OpenScripting
0x90bff000 - 0x913fcfef  com.apple.AppKit 6.5.2 (949.26) &lt;bc4593edd8a224409fb6953a354505a0&gt; /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit
0x913fd000 - 0x91413fe7  com.apple.CoreVideo 1.5.0 (1.5.0) &lt;bad2d3a9a92fdecd02e64f0b73a76f27&gt; /System/Library/Frameworks/CoreVideo.framework/Versions/A/CoreVideo
0x91414000 - 0x914c4fff  edu.mit.Kerberos 6.0.12 (6.0.12) &lt;3dd13466876a8fe4549cfc1354233ec3&gt; /System/Library/Frameworks/Kerberos.framework/Versions/A/Kerberos
0x914cb000 - 0x914d0fff  com.apple.CommonPanels 1.2.4 (85) &lt;ea0665f57cd267609466ed8b2b20e893&gt; /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/CommonPanels.framework/Versions/A/CommonPanels
0x91515000 - 0x9151cffe  libbsm.dylib ??? (???) &lt;d25c63378a5029648ffd4b4669be31bf&gt; /usr/lib/libbsm.dylib
0x9151d000 - 0x915e8fff  com.apple.ColorSync 4.5.0 (4.5.0) /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ColorSync.framework/Versions/A/ColorSync
0x915e9000 - 0x915e9fff  com.apple.Carbon 136 (136) &lt;98a5e3bc0c4fa44bbb09713bb88707fe&gt; /System/Library/Frameworks/Carbon.framework/Versions/A/Carbon
0x916ad000 - 0x916adff8  com.apple.Cocoa 6.5 (???) &lt;e064f94d969ce25cb7de3cfb980c3249&gt; /System/Library/Frameworks/Cocoa.framework/Versions/A/Cocoa
0x916ae000 - 0x916f3fef  com.apple.Metadata 10.5.2 (398.7) &lt;73a6424c06effc474e699cde6883de99&gt; /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Metadata
0x916f4000 - 0x9182cff7  libicucore.A.dylib ??? (???) &lt;afcea652ff2ec36885b2c81c57d06d4c&gt; /usr/lib/libicucore.A.dylib
0x9182d000 - 0x91c3dfef  libBLAS.dylib ??? (???) /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libBLAS.dylib
0x91c3e000 - 0x91c3effa  com.apple.CoreServices 32 (32) &lt;2fcc8f3bd5bbfc000b476cad8e6a3dd2&gt; /System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices
0x91c45000 - 0x91c4cfe9  libgcc_s.1.dylib ??? (???) &lt;f53c808e87d1184c0f9df63aef53ce0b&gt; /usr/lib/libgcc_s.1.dylib
0x91c4d000 - 0x91ce0ff3  com.apple.ApplicationServices.ATS 3.2 (???) &lt;cdf31bd0ac7de54a35ee2d27cf86b6be&gt; /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ATS.framework/Versions/A/ATS
0x91ce1000 - 0x91d13fff  com.apple.LDAPFramework 1.4.3 (106) &lt;3a5c9df6032143cd6bc2658a9d328d8e&gt; /System/Library/Frameworks/LDAP.framework/Versions/A/LDAP
0x91d19000 - 0x91d95feb  com.apple.audio.CoreAudio 3.1.0 (3.1) &lt;70bb7c657061631491029a61babe0b26&gt; /System/Library/Frameworks/CoreAudio.framework/Versions/A/CoreAudio
0x91d96000 - 0x91dbefff  libcups.2.dylib ??? (???) &lt;2f0a710a9128882efb2ed92ad139b58c&gt; /usr/lib/libcups.2.dylib
0x91dbf000 - 0x91e09fe1  com.apple.securityinterface 3.0 (32532) &lt;f521dae416ce7a3bdd594b0d4e2fb517&gt; /System/Library/Frameworks/SecurityInterface.framework/Versions/A/SecurityInterface
0x91e0a000 - 0x921c8fea  libLAPACK.dylib ??? (???) /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libLAPACK.dylib
0x921c9000 - 0x92254fff  com.apple.framework.IOKit 1.5.1 (???) &lt;a17f9f5ea7e8016a467e67349f4d3d03&gt; /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
0x9234a000 - 0x92377feb  libvDSP.dylib ??? (???) &lt;b232c018ddd040ec4e2c2af632dd497f&gt; /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libvDSP.dylib
0x92378000 - 0x92382feb  com.apple.audio.SoundManager 3.9.2 (3.9.2) &lt;0f2ba6e891d3761212cf5a5e6134d683&gt; /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/CarbonSound.framework/Versions/A/CarbonSound
0x925f9000 - 0x92901fff  com.apple.HIToolbox 1.5.2 (???) &lt;7449d6f2da33ded6936243a92e307459&gt; /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox
0x929a7000 - 0x929e0ffe  com.apple.securityfoundation 3.0 (32989) &lt;e9171eda22c69c884a04a001aeb526e0&gt; /System/Library/Frameworks/SecurityFoundation.framework/Versions/A/SecurityFoundation
0x92af2000 - 0x92bacfe3  com.apple.CoreServices.OSServices 224.4 (224.4) &lt;ff5007ab220908ac54b6c661e447d593&gt; /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/OSServices.framework/Versions/A/OSServices
0x92bad000 - 0x92c92ff3  com.apple.CoreData 100.1 (186) &lt;8e28162ef2288692615b52acc01f8b54&gt; /System/Library/Frameworks/CoreData.framework/Versions/A/CoreData
0x92c93000 - 0x92d1fff7  com.apple.LaunchServices 286.5 (286.5) &lt;33c3ae54abb276b61a99d4c764d883e2&gt; /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/LaunchServices
0x92d20000 - 0x92d28fff  com.apple.DiskArbitration 2.2.1 (2.2.1) &lt;75b0c8d8940a8a27816961dddcac8e0f&gt; /System/Library/Frameworks/DiskArbitration.framework/Versions/A/DiskArbitration
0x92d29000 - 0x92d39ffc  com.apple.LangAnalysis 1.6.4 (1.6.4) &lt;cbeb17ab39f28351fe2ab5b82bf465bc&gt; /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/LangAnalysis.framework/Versions/A/LangAnalysis
0x92e72000 - 0x93192fe2  com.apple.QuickTime 7.4.5 (67) &lt;520cbf4ae05622466ad1b89f1ba3a4e1&gt; /System/Library/Frameworks/QuickTime.framework/Versions/A/QuickTime
0x93193000 - 0x931bbff7  com.apple.shortcut 1 (1.0) &lt;057783867138902b52bc0941fedb74d1&gt; /System/Library/PrivateFrameworks/Shortcut.framework/Versions/A/Shortcut
0x931bc000 - 0x9368ffde  libGLProgrammability.dylib ??? (???) &lt;a3d68f17f37ff55a3e61aca1e3aee522&gt; /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLProgrammability.dylib
0x93690000 - 0x93742ffb  libcrypto.0.9.7.dylib ??? (???) &lt;330b0e48e67faffc8c22dfc069ca7a47&gt; /usr/lib/libcrypto.0.9.7.dylib
0x93743000 - 0x947f3ff6  com.apple.QuickTimeComponents.component 7.4.5 (67) /System/Library/QuickTime/QuickTimeComponents.component/Contents/MacOS/QuickTimeComponents
0x947f4000 - 0x9482bfff  com.apple.SystemConfiguration 1.9.1 (1.9.1) &lt;8a76e429301afe4eba1330bfeaabd9f2&gt; /System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
0x9482c000 - 0x94857fe7  libauto.dylib ??? (???) &lt;42d8422dc23a18071869fdf7b5d8fab5&gt; /usr/lib/libauto.dylib
0x94858000 - 0x94878ff2  libGL.dylib ??? (???) /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGL.dylib
0x94879000 - 0x9487bfff  com.apple.securityhi 3.0 (30817) &lt;2b2854123fed609d1820d2779e2e0963&gt; /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/SecurityHI.framework/Versions/A/SecurityHI
0x9487c000 - 0x9487cff8  com.apple.ApplicationServices 34 (34) &lt;8f910fa65f01d401ad8d04cc933cf887&gt; /System/Library/Frameworks/ApplicationServices.framework/Versions/A/ApplicationServices
0x9487e000 - 0x948bffe7  libRIP.A.dylib ??? (???) &lt;9d42e83d860433f9126c4871d1fe0ce8&gt; /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources/libRIP.A.dylib
0x94a45000 - 0x94a55fff  com.apple.speech.synthesis.framework 3.6.59 (3.6.59) &lt;4ffef145fad3d4d787e0c33eab26b336&gt; /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/SpeechSynthesis.framework/Versions/A/SpeechSynthesis
0x94a56000 - 0x94a56ffb  com.apple.installserver.framework 1.0 (8) /System/Library/PrivateFrameworks/InstallServer.framework/Versions/A/InstallServer
0x94c13000 - 0x94c1efe7  libCSync.A.dylib ??? (???) &lt;df82fc093e498a9eb5490761cb292218&gt; /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources/libCSync.A.dylib
0x94c1f000 - 0x94e99fe7  com.apple.Foundation 6.5.4 (677.15) &lt;6216196287f98a65ddb654d04d773e7b&gt; /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
0x94e9a000 - 0x94eb5ffb  libPng.dylib ??? (???) &lt;b6abcac36ec7654ff3e1cfa786b0117b&gt; /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libPng.dylib
0x94ee7000 - 0x94faeff2  com.apple.vImage 3.0 (3.0) /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vImage.framework/Versions/A/vImage
0x94faf000 - 0x9512dfff  com.apple.AddressBook.framework 4.1 (687.1) &lt;b2f2f2c925eb080e53b841014e4f9a7c&gt; /System/Library/Frameworks/AddressBook.framework/Versions/A/AddressBook
0x9512e000 - 0x951b7fe3  com.apple.DesktopServices 1.4.5 (1.4.5) &lt;8b264cd6abbbd750928c637e1247269d&gt; /System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/DesktopServicesPriv
0x951b8000 - 0x95215ffb  libstdc++.6.dylib ??? (???) &lt;04b812dcec670daa8b7d2852ab14be60&gt; /usr/lib/libstdc++.6.dylib
0x95216000 - 0x9521cfff  com.apple.print.framework.Print 218.0.2 (220.1) &lt;8bf7ef71216376d12fcd5ec17e43742c&gt; /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Print.framework/Versions/A/Print
0x9523b000 - 0x9523dfff  com.apple.CrashReporterSupport 10.5.0 (156) &lt;3088b785b10d03504ed02f3fee5d3aab&gt; /System/Library/PrivateFrameworks/CrashReporterSupport.framework/Versions/A/CrashReporterSupport
0x9523e000 - 0x958d7fff  com.apple.CoreGraphics 1.351.21 (???) &lt;6c93fd21149f389129fe47fa6ef71880&gt; /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics
0x958e6000 - 0x95988ff3  com.apple.QuickTimeImporters.component 7.4.5 (67) /System/Library/QuickTime/QuickTimeImporters.component/Contents/MacOS/QuickTimeImporters
0x95989000 - 0x95990ff7  libCGATS.A.dylib ??? (???) &lt;9b29a5500efe01cc3adea67bbc42568e&gt; /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources/libCGATS.A.dylib
0x95991000 - 0x9599dfe7  com.apple.opengl 1.5.6 (1.5.6) &lt;d599b1bb0f8a8da6fd125e2587b27776&gt; /System/Library/Frameworks/OpenGL.framework/Versions/A/OpenGL
0x9599e000 - 0x95a18ff8  com.apple.print.framework.PrintCore 5.5.2 (245.1) &lt;3c9de512e95fbd838694ee5008d56a28&gt; /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/PrintCore.framework/Versions/A/PrintCore
0x95a19000 - 0x95a98ff5  com.apple.SearchKit 1.2.0 (1.2.0) &lt;277b460da86bc222785159fe77e2e2ed&gt; /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/SearchKit.framework/Versions/A/SearchKit
0x95a99000 - 0x95ae9ff7  com.apple.HIServices 1.7.0 (???) &lt;f7e78891a6d08265c83dca8e378be1ea&gt; /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/HIServices.framework/Versions/A/HIServices
0x95bbe000 - 0x95bf4fef  libtidy.A.dylib ??? (???) &lt;e4d3e7399fb83d7f145f9b4ec8196242&gt; /usr/lib/libtidy.A.dylib
0x95bf5000 - 0x95c33ff7  libGLImage.dylib ??? (???) &lt;090de775838db03ddc710f57abbf6218&gt; /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLImage.dylib
0x95eb1000 - 0x95eb1ffc  com.apple.audio.units.AudioUnit 1.5 (1.5) /System/Library/Frameworks/AudioUnit.framework/Versions/A/AudioUnit
0x95eb2000 - 0x95eb6fff  libmathCommon.A.dylib ??? (???) /usr/lib/system/libmathCommon.A.dylib
0x95f08000 - 0x95f08ffd  com.apple.vecLib 3.4.2 (vecLib 3.4.2) /System/Library/Frameworks/vecLib.framework/Versions/A/vecLib
0x95f09000 - 0x95f2dfff  libxslt.1.dylib ??? (???) &lt;4933ddc7f6618743197aadc85b33b5ab&gt; /usr/lib/libxslt.1.dylib
0x95f2e000 - 0x95f68fff  com.apple.coreui 1.1 (61) /System/Library/PrivateFrameworks/CoreUI.framework/Versions/A/CoreUI
0x95f69000 - 0x95f70fff  com.apple.agl 3.0.9 (AGL-3.0.9) &lt;7dac4a7cb0de2f6d08ae71c1249379e3&gt; /System/Library/Frameworks/AGL.framework/Versions/A/AGL
0x965c2000 - 0x965e0fff  libresolv.9.dylib ??? (???) &lt;0629b6dcd71f4aac6a891cbe26253e85&gt; /usr/lib/libresolv.9.dylib
0x965e1000 - 0x96610fe3  com.apple.AE 402.2 (402.2) &lt;e01596187e91af5d48653920017b8c8e&gt; /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/AE.framework/Versions/A/AE
0x96616000 - 0x96655fef  libTIFF.dylib ??? (???) &lt;6d0f80e9d4d81f3f64c876aca005bd53&gt; /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libTIFF.dylib
0x96714000 - 0x96838fe3  com.apple.audio.toolbox.AudioToolbox 1.5.1 (1.5.1) /System/Library/Frameworks/AudioToolbox.framework/Versions/A/AudioToolbox
0x96877000 - 0x96956fff  libobjc.A.dylib ??? (???) &lt;a53206274b6c2d42691f677863f379ae&gt; /usr/lib/libobjc.A.dylib
0x96957000 - 0x9695afff  com.apple.help 1.1 (36) &lt;b507b08e484cb89033e9cf23062d77de&gt; /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Help.framework/Versions/A/Help
0x9695b000 - 0x9696affe  com.apple.DSObjCWrappers.Framework 1.2.1 (1.2.1) &lt;eac1c7b7c07ed3148c85934b6f656308&gt; /System/Library/PrivateFrameworks/DSObjCWrappers.framework/Versions/A/DSObjCWrappers
0x96a34000 - 0x96d0dff3  com.apple.CoreServices.CarbonCore 785.8 (785.8) &lt;827c228e7d717b397cdb4941eba69553&gt; /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/CarbonCore
0x96d0e000 - 0x96d1dfff  libsasl2.2.dylib ??? (???) &lt;b9e1ca0b6612e280b6cbea6df0eec5f6&gt; /usr/lib/libsasl2.2.dylib
0x96d1e000 - 0x96d2cffd  libz.1.dylib ??? (???) &lt;5ddd8539ae2ebfd8e7cc1c57525385c7&gt; /usr/lib/libz.1.dylib
0x96d2d000 - 0x96d2dffd  com.apple.Accelerate 1.4.2 (Accelerate 1.4.2) /System/Library/Frameworks/Accelerate.framework/Versions/A/Accelerate
0x96d2e000 - 0x96d42ff3  com.apple.ImageCapture 4.0 (5.0.0) /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/ImageCapture.framework/Versions/A/ImageCapture
0x96d78000 - 0x96dd4ff7  com.apple.htmlrendering 68 (1.1.3) &lt;fe87a9dede38db00e6c8949942c6bd4f&gt; /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HTMLRendering.framework/Versions/A/HTMLRendering
0x96dd5000 - 0x96f1aff7  com.apple.ImageIO.framework 2.0.1 (2.0.1) &lt;68ba11e689a9ca30f8310935cd1e02d6&gt; /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/ImageIO
0x96f1b000 - 0x96f5dfef  com.apple.NavigationServices 3.5.1 (161) &lt;cc6bd78eabf1e2e7166914e9f12f5850&gt; /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/NavigationServices.framework/Versions/A/NavigationServices
0x96fad000 - 0x96fcbff3  com.apple.DirectoryService.Framework 3.5.1 (3.5.1) &lt;96407dca4d6b1d10ae5ca1881e31b27a&gt; /System/Library/Frameworks/DirectoryService.framework/Versions/A/DirectoryService
0x96fcc000 - 0x97197ff7  com.apple.security 5.0.2 (33001) &lt;0788969ffe7961153219be10786da436&gt; /System/Library/Frameworks/Security.framework/Versions/A/Security
0x97198000 - 0x971a3ff9  com.apple.helpdata 1.0 (14) /System/Library/PrivateFrameworks/HelpData.framework/Versions/A/HelpData
0xfffe8000 - 0xfffebfff  libobjc.A.dylib ??? (???) /usr/lib/libobjc.A.dylib
0xffff0000 - 0xffff1780  libSystem.B.dylib ??? (???) /usr/lib/libSystem.B.dylib</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>80563</commentid>
    <comment_count>1</comment_count>
      <attachid>21183</attachid>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2008-05-15 15:17:05 -0700</bug_when>
    <thetext>Created attachment 21183
causes crash in release and debug builds</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>84586</commentid>
    <comment_count>2</comment_count>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2008-06-27 09:43:32 -0700</bug_when>
    <thetext>This no longer crashes in TOT.  Justin must have fixed this one as part of other editing changes.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="0"
              isprivate="0"
          >
            <attachid>21183</attachid>
            <date>2008-05-15 15:17:05 -0700</date>
            <delta_ts>2008-05-15 15:17:05 -0700</delta_ts>
            <desc>causes crash in release and debug builds</desc>
            <filename>editor-crash.html</filename>
            <type>text/html</type>
            <size>742</size>
            <attacher name="Eric Seidel (no email)">eric</attacher>
            
              <data encoding="base64">PGlmcmFtZSBpZD1mIG5hbWU9ZiBzcmM9ImFib3V0OmJsYW5rIiB3aWR0aD0xMDAlIGhlaWdodD01
MCU+PC9pZnJhbWU+CjxzY3JpcHQ+CnZhciBpZnJhbWUgPSBkb2N1bWVudC5nZXRFbGVtZW50QnlJ
ZCgiZiIpOwpkb2MgPSBpZnJhbWUuY29udGVudERvY3VtZW50Owpkb2MuYWRkRXZlbnRMaXN0ZW5l
cigiY2xpY2siLCBnb3RGb2N1cywgdHJ1ZSk7CmRvYy5kZXNpZ25Nb2RlID0gJ29uJzsKZnVuY3Rp
b24gZ290Rm9jdXMoKSB7CiAgZG9jLmV4ZWNDb21tYW5kKCdmb3JtYXRibG9jaycsIDEsICc8cHJl
PicpOwogIGRvYy5leGVjQ29tbWFuZCgnaW5zZXJ0aG9yaXpvbnRhbHJ1bGUnKTsKICBkb2MuZXhl
Y0NvbW1hbmQoJ2luZGVudCcpOwogIGRvYy5leGVjQ29tbWFuZCgnaW5zZXJ0aG9yaXpvbnRhbHJ1
bGUnKTsKICBkb2MuZXhlY0NvbW1hbmQoJ2p1c3RpZnlyaWdodCcpOwogIGRvYy5leGVjQ29tbWFu
ZCgnb3V0ZGVudCcpOwogIGRvYy5leGVjQ29tbWFuZCgnaW5zZXJ0cGFyYWdyYXBoJyk7CiAgZG9j
LmV4ZWNDb21tYW5kKCdvdXRkZW50Jyk7CiAgZG9jLmV4ZWNDb21tYW5kKCdzZWxlY3RhbGwnKTsK
ICBkb2MuZXhlY0NvbW1hbmQoJ2luc2VydGhvcml6b250YWxydWxlJyk7Cn0KaWYgKHdpbmRvdy5l
dmVudFNlbmRlcikgewogIGV2ZW50U2VuZGVyLm1vdXNlTW92ZVRvKDEwMCwgMTAwKTsKICBldmVu
dFNlbmRlci5tb3VzZURvd24oKTsKICBldmVudFNlbmRlci5tb3VzZVVwKCk7Cn0KPC9zY3JpcHQ+
Cg==
</data>

          </attachment>
      

    </bug>

</bugzilla>