26076 2009-05-29 03:08:34 -0700 Custom highlighting (via -webkit-highlight) can crash 2017-06-16 22:32:22 -0700 1 1 1 Unclassified WebKit WebKit API 528+ (Nightly build) Mac OS X 10.5 RESOLVED CONFIGURATION CHANGED https://bugs.webkit.org/show_bug.cgi?id=128456 Regression P2 Major --- 0 kai webkit-unassigned mitz oldest_to_newest 123533 0 kai 2009-05-29 03:08:34 -0700 The functions WebChromeClient::customHighlightRect() and WebChromeClient::paintCustomHighlight() get passed a node. With Changeset 40871 (committed 2009-02-11), the passed node can be 0, which results in a crash. I include a test case which crashes when opening. 123534 1 30771 kai 2009-05-29 03:09:28 -0700 Created attachment 30771 Test case - crashes on loading 123535 2 kai 2009-05-29 03:16:37 -0700 I forgot to mention that the problem is triggered by having generated content in the document (via h1:empty:before {content:"some text";} in this case). I do not know whether this is the only way to trigger the problem, though. 1320344 3 mitz 2017-06-16 22:32:22 -0700 paintCustomHighlight and the SPI that relied on it have been removed via bug 128456. 30771 2009-05-29 03:09:28 -0700 2009-05-29 03:09:28 -0700 Test case - crashes on loading paintCustomHighlight-regression.xhtml application/xhtml+xml 475 kai PCFET0NUWVBFIGh0bWwgUFVCTElDICItLy9XM0MvL0RURCBYSFRNTCAxLjAgU3RyaWN0Ly9FTiIK ICAgICJodHRwOi8vd3d3LnczLm9yZy9UUi94aHRtbDEvRFREL3hodG1sMS1zdHJpY3QuZHRkIj4K PGh0bWwgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGh0bWwiPgo8c3R5bGU+CiAgICBo MTplbXB0eTpiZWZvcmUKICAgIHsKICAgICAgICBjb250ZW50OiJwYWludEN1c3RvbUhpZ2hsaWdo dCBjcmFzaCAocmVncmVzc2lvbikiOwogICAgfQogICAgKgogICAgewogICAgICAgIC13ZWJraXQt aGlnaGxpZ2h0OidTZWxlY3Rpb24nOwogICAgfQo8L3N0eWxlPgo8aGVhZD4KICAgIDx0aXRsZT48 L3RpdGxlPgo8L2hlYWQ+Cjxib2R5PgogICAgPGgxLz4KICAgIDxwPkluIGJ1aWxkcyB3aGljaCBp bmNsdWRlIGNoYW5nZXNldCA0MDg3MSB0aGlzIHBhZ2Ugd2lsbCBjcmFzaCBvbiBvcGVuaW5nLjwv cD4KPC9ib2R5Pgo8L2h0bWw+Cg==