32424 2009-12-11 04:43:34 -0800 WebCore::ReplaceSelectionCommand::doApply ReadAV@NULL (15d09a1a5a07b619154c5a2a36579bfd) 2009-12-31 02:32:09 -0800 1 1 1 Unclassified WebKit HTML Editing 528+ (Nightly build) PC Windows Vista RESOLVED DUPLICATE 32823 http://skypher.com/SkyLined/Repro/WebKit/Bug%2032424%20-%20WebCore..ReplaceSelectionCommand..doApply%20ReadAV@NULL%20(15d09a1a5a07b619154c5a2a36579bfd)/repro.html P1 Normal --- 1 skylined webkit-unassigned enrica eric oldest_to_newest 170693 0 44671 skylined 2009-12-11 04:43:34 -0800 Created attachment 44671 Repro Id: WebCore::ReplaceSelectionCommand::doApply ReadAV@NULL (15d09a1a5a07b619154c5a2a36579bfd) Description: Attempt to read from NULL pointer (+0x25) in WebCore::ReplaceSelectionCommand::doApply Stack: WebCore::ReplaceSelectionCommand::doApply WebCore::EditCommand::apply WebCore::applyCommand WebCore::executeInsertFragment WebCore::executeInsertHTML WebCore::Editor::Command::execute WebCore::Document::execCommand WebCore::DocumentInternal::execCommandCallback v8::internal::Builtin_HandleApiCall v8::internal::Invoke v8::internal::Execution::Call v8::Script::Run WebCore::V8Proxy::runScript WebCore::V8Proxy::evaluate WebCore::ScriptController::evaluate WebCore::ScriptController::executeScript WebCore::ScriptController::executeScript WebCore::ScriptController::executeIfJavaScriptURL WebCore::FrameLoader::changeLocation WebCore::RedirectScheduler::timerFired WebCore::Timer<...>::fired WebCore::ThreadTimers::sharedTimerFiredInternal MessageLoop::RunTask MessageLoop::DoWork base::MessagePumpDefault::Run MessageLoop::RunInternal MessageLoop::Run RendererMain ChromeMain Repro: <BODY onload=go()></BODY> <SCRIPT> function go() { document.execCommand("selectall",false,6); document.designMode="on"; document.execCommand("Cut",false,2); document.execCommand("inserthorizontalrule",""); document.execCommand("Delete",false, ""); document.designMode=""; document.execCommand("Undo",""); document.designMode="on"; document.execCommand("InsertHTML",false,""); } </SCRIPT> 170694 1 skylined 2009-12-11 04:44:39 -0800 Online repro 176161 2 skylined 2009-12-31 02:32:09 -0800 Mike Moretti claims there is a problem with "Undo" after "designmode off". https://bugs.webkit.org/show_bug.cgi?id=32822 I am assuming this is a variation of that problem. *** This bug has been marked as a duplicate of bug 32823 *** 44671 2009-12-11 04:43:34 -0800 2009-12-11 04:43:34 -0800 Repro repro.html text/html 427 skylined PEJPRFkgb25sb2FkPWdvKCk+PC9CT0RZPgo8U0NSSVBUPgogIGZ1bmN0aW9uIGdvKCkgewogICAg ZG9jdW1lbnQuZXhlY0NvbW1hbmQoInNlbGVjdGFsbCIsZmFsc2UsNik7CiAgICBkb2N1bWVudC5k ZXNpZ25Nb2RlPSJvbiI7CiAgICBkb2N1bWVudC5leGVjQ29tbWFuZCgiQ3V0IixmYWxzZSwyKTsK ICAgIGRvY3VtZW50LmV4ZWNDb21tYW5kKCJpbnNlcnRob3Jpem9udGFscnVsZSIsIiIpOwogICAg ZG9jdW1lbnQuZXhlY0NvbW1hbmQoIkRlbGV0ZSIsZmFsc2UsICIiKTsKICAgIGRvY3VtZW50LmRl c2lnbk1vZGU9IiI7CiAgICBkb2N1bWVudC5leGVjQ29tbWFuZCgiVW5kbyIsIiIpOwogICAgZG9j dW1lbnQuZGVzaWduTW9kZT0ib24iOwogICAgZG9jdW1lbnQuZXhlY0NvbW1hbmQoIkluc2VydEhU TUwiLGZhbHNlLCIiKTsKICB9CjwvU0NSSVBUPg==