38591 2010-05-05 09:48:11 -0700 [Chromium]: FindInPage crash on sites.google.com 2010-05-07 11:06:08 -0700 1 1 1 Unclassified WebKit New Bugs 528+ (Nightly build) All All RESOLVED FIXED P2 Normal --- 0 finnur.webkit webkit-unassigned commit-queue oldest_to_newest 221149 0 finnur.webkit 2010-05-05 09:48:11 -0700 Originally reported as: http://code.google.com/p/chromium/issues/detail?id=43083 In short, if you... 1) FindInPage on a Google Sites page you have edit permissions on 2) (without closing the Find box in Chromium) you edit the Sites page 3) click FindNext Then you'll crash inside WebCore::Node::nodeIndex... 002cf084 69ad6b5a chrome_69aa0000!WebCore::Node::nodeIndex+0x7 002cf088 69ad9099 chrome_69aa0000!WebCore::RangeBoundaryPoint::offset+0xe 002cf094 69b32113 chrome_69aa0000!WebCore::Range::pastLastNode+0x30 002cf0c8 69cfbbaf chrome_69aa0000!WebCore::Document::setMarkersActive+0x42 002cf1dc 69e60393 chrome_69aa0000!WebKit::WebFrameImpl::find+0x5d 002cf264 69e68e66 chrome_69aa0000!RenderView::OnFind+0x13a What is happening is that setMarkersActive is not checking for collapsed ranges, so we use a range with invalid RangeBoundaryPoints. I have a fix. 221974 1 55299 finnur.webkit 2010-05-06 14:44:59 -0700 Created attachment 55299 Propsed fix 221976 2 finnur.webkit 2010-05-06 14:46:07 -0700 I should add that I tried for a few hours to create a reduced test case for this, but was unable to get it to repro the problem. 221984 3 55299 dglazkov 2010-05-06 14:54:25 -0700 Comment on attachment 55299 Propsed fix ok. 222490 4 55299 commit-queue 2010-05-07 11:06:03 -0700 Comment on attachment 55299 Propsed fix Clearing flags on attachment: 55299 Committed r58958: <http://trac.webkit.org/changeset/58958> 222491 5 commit-queue 2010-05-07 11:06:08 -0700 All reviewed patches have been landed. Closing bug. 55299 2010-05-06 14:44:59 -0700 2010-05-07 11:06:02 -0700 Propsed fix find_fix.patch text/plain 1351 finnur.webkit SW5kZXg6IFdlYktpdC9jaHJvbWl1bS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gV2ViS2l0L2No cm9taXVtL0NoYW5nZUxvZwkocmV2aXNpb24gNTg5MDgpCisrKyBXZWJLaXQvY2hyb21pdW0vQ2hh bmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTcgQEAKKzIwMTAtMDUtMDYgIEZpbm51 ciBUaG9yYXJpbnNzb24gIDxmaW5udXIud2Via2l0QGdtYWlsLmNvbT4KKworICAgICAgICBSZXZp ZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBbY2hyb21pdW1dOiBGaXhpbmcgRmlu ZCBpbiBwYWdlIGNyYXNoIG9uIHNpdGVzLmdvb2dsZS5jb20KKyAgICAgICAgaHR0cHM6Ly9idWdz LndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTM4NTkxCisgICAgICAgIAorICAgICAgICBzZXRN YXJrZXJBY3RpdmUgc2hvdWxkIG5vdCB0cnkgdG8gc2V0IGEgY29sbGFwc2VkIG1hcmtlciBhcwor ICAgICAgICBhY3RpdmUuIFRoaXMgY2FuIGhhcHBlbiB3aGVuIHlvdSBFZGl0IGEgU2l0ZXMgcGFn ZSBhZnRlciBkb2luZworICAgICAgICBhIEZpbmQgb3BlcmF0aW9uIGFuZCB0aGVuIHlvdSBwcmVz cyBGaW5kTmV4dC4KKyAgICAgICAgCisgICAgICAgICogc3JjL1dlYkZyYW1lSW1wbC5jcHA6Cisg ICAgICAgIChXZWJLaXQ6OldlYkZyYW1lSW1wbDo6c2V0TWFya2VyQWN0aXZlKToKKwogMjAxMC0w NS0wNiAgUGF2ZWwgRmVsZG1hbiAgPHBmZWxkbWFuQGNocm9taXVtLm9yZz4KIAogICAgICAgICBS ZXZpZXdlZCBieSBUaW1vdGh5IEhhdGNoZXIuCkluZGV4OiBXZWJLaXQvY2hyb21pdW0vc3JjL1dl YkZyYW1lSW1wbC5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gV2ViS2l0L2Nocm9taXVtL3NyYy9XZWJGcmFt ZUltcGwuY3BwCShyZXZpc2lvbiA1ODkwOCkKKysrIFdlYktpdC9jaHJvbWl1bS9zcmMvV2ViRnJh bWVJbXBsLmNwcAkod29ya2luZyBjb3B5KQpAQCAtMjAzMCw3ICsyMDMwLDggQEAgdm9pZCBXZWJG cmFtZUltcGw6OmFkZE1hcmtlcihSYW5nZSogcmFuZwogCiB2b2lkIFdlYkZyYW1lSW1wbDo6c2V0 TWFya2VyQWN0aXZlKFJhbmdlKiByYW5nZSwgYm9vbCBhY3RpdmUpCiB7Ci0gICAgaWYgKCFyYW5n ZSkKKyAgICBXZWJDb3JlOjpFeGNlcHRpb25Db2RlIGVjOworICAgIGlmICghcmFuZ2UgfHwgcmFu Z2UtPmNvbGxhcHNlZChlYykpCiAgICAgICAgIHJldHVybjsKIAogICAgIGZyYW1lKCktPmRvY3Vt ZW50KCktPnNldE1hcmtlcnNBY3RpdmUocmFuZ2UsIGFjdGl2ZSk7Cg==