37197 2010-04-07 03:10:34 -0700 Crash with -webkit-user-select and contenteditables 2010-06-06 05:51:27 -0700 1 1 1 Unclassified WebKit WebCore Misc. 528+ (Nightly build) PC OS X 10.5 RESOLVED DUPLICATE 39989 P2 Normal --- 0 zuh webkit-unassigned oldest_to_newest 209553 0 52721 zuh 2010-04-07 03:10:34 -0700 Created attachment 52721 A QtWebKit test program for the crash Using this snippet of CSS as the user CSS: * { -webkit-user-select: none !important; } *[contenteditable], *[contenteditable=true] { -webkit-user-select: text !important; } and the rich text tests of browserscope at http://www.browserscope.org/richtext/test makes WebKit crash with a backtrace like #0 0xb6d98c39 in WebCore::ApplyStyleCommand::splitTextElementAtEndIfNeeded(WebCore::Position const&, WebCore::Position const&) () from WebKitBuild/Release/lib/libQtWebKit.so.4 #1 0xb6da1aa8 in WebCore::ApplyStyleCommand::applyInlineStyle(WebCore::CSSMutableStyleDeclaration*) () from WebKitBuild/Release/lib/libQtWebKit.so.4 #2 0xb6da36c3 in WebCore::ApplyStyleCommand::doApply() () from WebKitBuild/Release/lib/libQtWebKit.so.4 #3 0xb6dba7e2 in WebCore::EditCommand::apply() () from WebKitBuild/Release/lib/libQtWebKit.so.4 #4 0xb6dbd2df in WebCore::Editor::applyStyle(WebCore::CSSStyleDeclaration*, WebCore::EditAction) () from WebKitBuild/Release/lib/libQtWebKit.so.4 #5 0xb6dc70d4 in WebCore::applyCommandToFrame(WebCore::Frame*, WebCore::EditorCommandSource, WebCore::EditAction, WebCore::CSSMutableStyleDeclaration*) () from WebKitBuild/Release/lib/libQtWebKit.so.4 #6 0xb6dc9735 in WebCore::executeApplyStyle(WebCore::Frame*, WebCore::EditorCommandSource, WebCore::EditAction, int, WebCore::String const&) () from WebKitBuild/Release/lib/libQtWebKit.so.4 #7 0xb6dc6fbe in WebCore::Editor::Command::execute(WebCore::String const&, WebCore::Event*) const () from WebKitBuild/Release/lib/libQtWebKit.so.4 #8 0xb6d2e7f9 in WebCore::Document::execCommand(WebCore::String const&, bool, WebCore::String const&) () from WebKitBuild/Release/lib/libQtWebKit.so.4 #9 0xb68c1a58 in WebCore::jsDocumentPrototypeFunctionExecCommand(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, JSC::ArgList const&) () 233361 1 ap 2010-06-02 11:33:20 -0700 Can this be reproduced in a browser? See also: bug 39989. 234654 2 zuh 2010-06-06 05:51:27 -0700 (In reply to comment #1) > Can this be reproduced in a browser? Yes, for example Google Chrome 6.0.414.0 (48010) on Ubuntu exhibits this crash after pasting the snippet to $profile/User StyleSheets/Custom.css > See also: bug 39989. Judging from the description and backtrace, these bugs are quite likely the same. Although this bug is older, I'll mark this as dupe of bug 39989 since it has a better testcase. *** This bug has been marked as a duplicate of bug 39989 *** 52721 2010-04-07 03:10:34 -0700 2010-04-07 03:10:34 -0700 A QtWebKit test program for the crash contenteditable-css-crash.cpp text/x-c++src 551 zuh I2luY2x1ZGUgPFFBcHBsaWNhdGlvbj4KI2luY2x1ZGUgPFF0V2ViS2l0PgoKI2RlZmluZSBDU1Mg IiIgXAoiKiB7IC13ZWJraXQtdXNlci1zZWxlY3Q6IG5vbmUgIWltcG9ydGFudDsgfSIgXA0KIipb Y29udGVudGVkaXRhYmxlXSwgKltjb250ZW50ZWRpdGFibGU9dHJ1ZV0geyAtd2Via2l0LXVzZXIt c2VsZWN0OiB0ZXh0ICFpbXBvcnRhbnQ7IH0iIFwNCgppbnQgbWFpbihpbnQgYXJnYywgY2hhciAq KmFyZ3YpCnsKICBRQXBwbGljYXRpb24gYXBwKGFyZ2MsIGFyZ3YpOwogIFFXZWJWaWV3IHc7CiAg UVN0cmluZyB1c2VyQ1NTID0gImRhdGE6dGV4dC9jc3M7Y2hhcnNldD11dGYtODtiYXNlNjQsIjsK ICB1c2VyQ1NTLmFwcGVuZChRU3RyaW5nKENTUykudG9VdGY4KCkudG9CYXNlNjQoKSk7CiAgdy5z ZXR0aW5ncygpLT5zZXRVc2VyU3R5bGVTaGVldFVybCh1c2VyQ1NTKTsKICB3LmxvYWQoUVVybCgi aHR0cDovL3d3dy5icm93c2Vyc2NvcGUub3JnL3JpY2h0ZXh0L3Rlc3Q/YXV0b3J1bj0xIikpOwog IHcuc2hvdygpOwogIAogIHJldHVybiBhcHAuZXhlYygpOwp9Cgo=