36800 2010-03-29 19:25:24 -0700 Ownerless nodes leads a crash on DOMSelection APIs 2010-04-01 22:33:17 -0700 1 1 1 Unclassified WebKit HTML Editing 528+ (Nightly build) PC OS X 10.5 RESOLVED FIXED P2 Normal --- 0 morrita webkit-unassigned oldest_to_newest 205804 0 morrita 2010-03-29 19:25:24 -0700 Passing ownerless node to DOMSelection APIs including collapse(), extend(), selectAllChildren(), setPosition() causes a crash. One type of ownerless node is newly-created DocumentType object. This is similar to Bug 31680 and the fix on Bug 31680 will fix these. But we need regressions for that. 205915 1 52015 morrita 2010-03-30 02:40:28 -0700 Created attachment 52015 to reproduce 207677 2 morrita 2010-04-01 22:33:17 -0700 Fixed at http://trac.webkit.org/changeset/56962 52015 2010-03-30 02:40:28 -0700 2010-03-30 02:40:28 -0700 to reproduce 31680-2.html text/html 326 morrita PFNDUklQVD4KICBkb2NUeXBlID0gZG9jdW1lbnQuaW1wbGVtZW50YXRpb24uY3JlYXRlRG9jdW1l bnRUeXBlKCdjJyk7CiAgLy8gRXZlcnkgb25lIG9mIHRoZXNlIGNhbGwgY2FuIGxlYWQgYSBjcmFz aC4KICBkb2N1bWVudC5nZXRTZWxlY3Rpb24oKS5jb2xsYXBzZShkb2NUeXBlKTsKICBkb2N1bWVu dC5nZXRTZWxlY3Rpb24oKS5leHRlbmQoZG9jVHlwZSwgMCk7CiAgZG9jdW1lbnQuZ2V0U2VsZWN0 aW9uKCkuc2VsZWN0QWxsQ2hpbGRyZW4oZG9jVHlwZSwgMCk7CiAgZG9jdW1lbnQuZ2V0U2VsZWN0 aW9uKCkuc2V0UG9zaXRpb24oZG9jVHlwZSwgMCk7CjwvU0NSSVBUPgo=