34568 2010-02-04 02:07:38 -0800 2x execCommand ReadAV@NULL 2010-04-06 22:47:24 -0700 1 1 1 Unclassified WebKit HTML Editing 528+ (Nightly build) PC Windows Vista RESOLVED DUPLICATE 35791 P1 Normal --- 1 skylined webkit-unassigned eric joepeck oldest_to_newest 187690 0 skylined 2010-02-04 02:07:38 -0800 Repro: <BODY></BODY> <SCRIPT> document.designMode = "on"; document.execCommand("selectall"); document.execCommand("InsertLineBreak"); document.execCommand("InsertLineBreak"); document.execCommand("forecolor", false, 1); // Optional, see note document.execCommand("InsertText", false, 1); document.execCommand("SelectAll"); document.execCommand("createlink", false, 1); document.execCommand("justifycenter", false); </SCRIPT> The "forecolor" line is optional: there are two different crashes that can happen, one with it and one without (latest non-debug build of Chromium): WebCore::Node::shadowAncestorNode ReadAV@NULL (3b90161564d80c611251f74d8780bd91) WebCore::CSSStyleDeclaration::diff ReadAV@NULL (2b02a76b8ac89beb9292332299f74c09) Both repro's trigger ASSERTs in debug builds. Details and repros are attached to the chromium bug: http://code.google.com/p/chromium/issues/detail?id=34575 209456 1 joepeck 2010-04-06 22:47:24 -0700 *** This bug has been marked as a duplicate of bug 35791 ***