33049 2009-12-30 03:48:36 -0800 WebCore::positionInParentBeforeNode ReadAV@NULL (98882320ea2b731f10f353b23849bd6a) 2009-12-31 02:32:39 -0800 1 1 1 Unclassified WebKit HTML Editing 528+ (Nightly build) PC Windows Vista RESOLVED DUPLICATE 32823 http://skypher.com/SkyLined/Repro/WebKit/Bug%2033049%20-%20WebCore..positionInParentBeforeNode%20ReadAV@NULL%20(98882320ea2b731f10f353b23849bd6a)/repro.html P1 Normal --- 1 skylined webkit-unassigned enrica eric oldest_to_newest 175868 0 45652 skylined 2009-12-30 03:48:36 -0800 Created attachment 45652 Repro Id: WebCore::positionInParentBeforeNode ReadAV@NULL (98882320ea2b731f10f353b23849bd6a) Description: Attempt to read from NULL pointer (+0xC) in WebCore::positionInParentBeforeNode Stack: WebCore::positionInParentBeforeNode WebCore::InsertTextCommand::input WebCore::TypingCommand::insertTextRunWithoutNewlines WebCore::TypingCommand::insertText WebCore::TypingCommand::doApply WebCore::EditCommand::apply WebCore::applyCommand WebCore::TypingCommand::insertText WebCore::TypingCommand::insertText WebCore::executeInsertText WebCore::Editor::Command::execute WebCore::Document::execCommand WebCore::DocumentInternal::execCommandCallback v8::internal::Builtin_HandleApiCall v8::internal::Invoke v8::internal::Execution::Call v8::Script::Run WebCore::V8Proxy::runScript WebCore::V8Proxy::evaluate WebCore::ScriptController::evaluate WebCore::ScriptController::executeScript WebCore::ScriptController::executeScript WebCore::ScriptController::executeIfJavaScriptURL WebCore::FrameLoader::changeLocation WebCore::RedirectScheduler::timerFired WebCore::Timer<...>::fired WebCore::ThreadTimers::sharedTimerFiredInternal MessageLoop::RunTask MessageLoop::DoWork base::MessagePumpDefault::Run MessageLoop::RunInternal MessageLoop::Run RendererMain Event details Processes 0 id: df8 create name: chrome.exe . 1 id: 9d4 child name: chrome.exe Threads . 12 Id: 9d4.51c Suspend: 1 Teb: 7ffdf000 Unfrozen "Main Thread" 14 Id: 9d4.774 Suspend: 1 Teb: 7ffde000 Unfrozen 15 Id: 9d4.930 Suspend: 1 Teb: 7ffdd000 Unfrozen "Chrome_ChildIOThread" 16 Id: 9d4.a94 Suspend: 1 Teb: 7ffdc000 Unfrozen ExceptionAddress 0248fbba (chrome_1c30000!WebCore::positionInParentBeforeNode+0x0000000a) ExceptionCode c0000005 (Access violation) ExceptionFlags 00000000 NumberParameters 2 Parameter[0] 00000000 Parameter[1] 0000000c Attempt to read from address 0000000c 175869 1 45653 skylined 2009-12-30 03:49:35 -0800 Created attachment 45653 Repro 175870 2 skylined 2009-12-30 03:51:17 -0800 I am also seeing this crash for this case: Id: WebCore::InsertTextCommand::prepareForTextInsertion ReadAV@NULL (1ac71298082910ad4b85996091be4ef8) Description: Attempt to read from NULL pointer (+0x25) in WebCore::InsertTextCommand::prepareForTextInsertion Stack: WebCore::InsertTextCommand::prepareForTextInsertion WebCore::InsertTextCommand::input WebCore::TypingCommand::insertTextRunWithoutNewlines WebCore::TypingCommand::insertText WebCore::TypingCommand::doApply WebCore::EditCommand::apply WebCore::applyCommand WebCore::TypingCommand::insertText WebCore::TypingCommand::insertText WebCore::executeInsertText WebCore::Editor::Command::execute WebCore::Document::execCommand WebCore::DocumentInternal::execCommandCallback v8::internal::Builtin_HandleApiCall v8::internal::Invoke v8::internal::Execution::Call v8::Script::Run WebCore::V8Proxy::runScript WebCore::V8Proxy::evaluate WebCore::ScriptController::evaluate WebCore::ScriptController::executeScript WebCore::ScriptController::executeScript WebCore::ScriptController::executeIfJavaScriptURL WebCore::FrameLoader::changeLocation WebCore::RedirectScheduler::timerFired WebCore::Timer<...>::fired WebCore::ThreadTimers::sharedTimerFiredInternal MessageLoop::RunTask MessageLoop::DoWork base::MessagePumpDefault::Run MessageLoop::RunInternal MessageLoop::Run RendererMain 176152 3 skylined 2009-12-31 00:55:00 -0800 http://skypher.com/SkyLined/Repro/WebKit/Bug%2033049%20-%20WebCore..positionInParentBeforeNode%20ReadAV@NULL%20(98882320ea2b731f10f353b23849bd6a)/repro2.html 176165 4 skylined 2009-12-31 02:32:39 -0800 Mike Moretti claims there is a problem with "Undo" after "designmode off". https://bugs.webkit.org/show_bug.cgi?id=32822 I am assuming this is a variation of that problem. *** This bug has been marked as a duplicate of bug 32823 *** 45652 2009-12-30 03:48:36 -0800 2009-12-30 03:48:36 -0800 Repro repro.html text/html 1265 skylined PEJPRFk+PC9CT0RZPg0KPFNDUklQVD4NCmRvY3VtZW50LmV4ZWNDb21tYW5kKCJPdXRkZW50Iiwg ZmFsc2UsIDI2MjE0MCk7DQpkb2N1bWVudC5kZXNpZ25Nb2RlID0gIm9uIjsNCmRvY3VtZW50LmV4 ZWNDb21tYW5kKCJTZWxlY3RBbGwiLCBmYWxzZSwgImh0dHBzOi8vd3d3LmV4YW1wbGUuY29tIik7 DQpkb2N1bWVudC5leGVjQ29tbWFuZCgiaW5zZXJ0aW1hZ2UiLCBmYWxzZSwgImRhdGE6aW1hZ2Uv cG5nO2Jhc2U2NCxpVkJPUncwS0dya0pnZ2c9PSIpOw0KZG9jdW1lbnQuZXhlY0NvbW1hbmQoInNl bGVjdGFsbCIsIGZhbHNlLCBOYU4pOw0KZG9jdW1lbnQuZXhlY0NvbW1hbmQoInN0cmlrZXRocm91 Z2giLCBmYWxzZSwgImdvcGhlcjovL3d3dy5leGFtcGxlLmNvbSIpOw0KZG9jdW1lbnQuZXhlY0Nv bW1hbmQoIk1vdmVXb3JkRm9yd2FyZCIsIGZhbHNlLCA0MTAwKTsNCmRvY3VtZW50LmV4ZWNDb21t YW5kKCJqdXN0aWZ5ZnVsbCIsIGZhbHNlLCA0MDkyKTsNCmRvY3VtZW50LmV4ZWNDb21tYW5kKCJP dmVyV3JpdGUiLCBmYWxzZSwgNCk7DQpkb2N1bWVudC5kZXNpZ25Nb2RlID0gIm9mZiI7DQpkb2N1 bWVudC5leGVjQ29tbWFuZCgib3V0ZGVudCIsIGZhbHNlLCAxNjM5MSk7DQpkb2N1bWVudC5leGVj Q29tbWFuZCgicGFzdGUiLCBmYWxzZSwgSW5maW5pdHkpOw0KZG9jdW1lbnQuZXhlY0NvbW1hbmQo ImRlY3JlYXNlZm9udHNpemUiLCBmYWxzZSwgMjY4NDM1NDU2KTsNCmRvY3VtZW50LmV4ZWNDb21t YW5kKCJVbmRvIiwgZmFsc2UsICJkYXRhOnRleHQvaHRtbDtjaGFyc2V0PXV0Zi04LCUzQyFET0NU WVBFJTIwSFRNTCUyMFBVQkxJQyUyMCUyMi0lMkYlMkZXM0MlMkYlMkZEVEQlMjBIVE1MJXRsZSUz RSUzQyUyRmhlYWQlM0UlMEQlMEElM0Nib2R5JTNFJTNDaDElM0U0MiUzQyUyRmgxJTNFJTNDJTJG Ym9keSUzRSUwRCUwQSUzQyUyRmh0bWwlM0UlMEQlMEEiKTsNCmRvY3VtZW50LmRlc2lnbk1vZGUg PSAib24iOw0KZG9jdW1lbnQuZXhlY0NvbW1hbmQoIlBhc3RlQW5kTWF0Y2hTdHlsZSIsIGZhbHNl LCAiPGlucHV0IHR5cGU9c3VibVx0XHRcdFx0XHRcdFx0XHRcdFx0XHRcdFx0XHRcdFx4YTdceGE3 XHhhN1x4YTcsXCcgZGlhbG9nSGVpZ2h0PWBzc3Nzc3Nzc1x4MDZceDA2XHgwNlx4MDZceDA2XHgw Nlx4MDZceDA2XHgwNlx4MDZceGJhXHhiYWAgY291bnRlckluY3JlbWVuIik7DQpkb2N1bWVudC5l eGVjQ29tbWFuZCgiSW5zZXJ0VGV4dCIsIGZhbHNlLCAiZnRwOi8vd3d3LmV4YW1wbGUuY29tIik7 DQo8L1NDUklQVD4= 45653 2009-12-30 03:49:35 -0800 2009-12-30 03:49:35 -0800 Repro repro2.html text/html 807 skylined PEJPRFk+PC9CT0RZPgo8U0NSSVBUPgpkb2N1bWVudC5leGVjQ29tbWFuZCgiT3V0ZGVudCIsIGZh bHNlLCAyNjIxNDApOwpkb2N1bWVudC5kZXNpZ25Nb2RlID0gIm9uIjsKZG9jdW1lbnQuZXhlY0Nv bW1hbmQoIlNlbGVjdEFsbCIsIGZhbHNlLCAiaHR0cHM6Ly93d3cuZXhhbXBsZS5jb20iKTsKZG9j dW1lbnQuZXhlY0NvbW1hbmQoImluc2VydGltYWdlIiwgZmFsc2UsICJkYXRhOmltYWdlL3BuZzti YXNlNjQsaVZCT1J3MEtHcmtKZ2dnPT0iKTsKZG9jdW1lbnQuZXhlY0NvbW1hbmQoInNlbGVjdGFs bCIsIGZhbHNlLCBOYU4pOwpkb2N1bWVudC5leGVjQ29tbWFuZCgianVzdGlmeWZ1bGwiLCBmYWxz ZSwgNDA5Mik7CmRvY3VtZW50LmV4ZWNDb21tYW5kKCJPdmVyV3JpdGUiLCBmYWxzZSwgNCk7CmRv Y3VtZW50LmRlc2lnbk1vZGUgPSAib2ZmIjsKZG9jdW1lbnQuZXhlY0NvbW1hbmQoIlVuZG8iLCBm YWxzZSwgImRhdGE6dGV4dC9odG1sO2NoYXJzZXQ9dXQwQSIpOwpkb2N1bWVudC5kZXNpZ25Nb2Rl ID0gIm9uIjsKZG9jdW1lbnQuZXhlY0NvbW1hbmQoIlBhc3RlQW5kTWF0Y2hTdHlsZSIsIGZhbHNl LCAiPGlucHV0IHR5cGU9c3VibVx0XHRcdFx0XHRcdFx0XHRcdFx0XHRcdFx0XHRcdFx4YTdceGE3 XHhhN1x4YTcsXCcgZGlhbG9nSGVpZ2h0PWBzc3Nzc3Nzc1x4MDZceDA2XHgwNlx4MDZceDA2XHgw Nlx4MDZceDA2XHgwNlx4MDZceGJhXHhiYWAgY291bnRlckluY3JlbWVuIik7CmRvY3VtZW50LmV4 ZWNDb21tYW5kKCJJbnNlcnRUZXh0IiwgZmFsc2UsICJmdHA6Ly93d3cuZXhhbXBsZS5jb20iKTsK PC9TQ1JJUFQ+