50218 2010-11-30 02:53:39 -0800 chrome.dll!WebCore::canHaveChildrenForEditing ReadAV@NULL (4c335fdc0441ae912c5dd65199668a34) 2017-07-18 08:26:00 -0700 1 1 1 Unclassified WebKit HTML Editing 528+ (Nightly build) All All NEW http://code.google.com/p/chromium/issues/detail?id=64749 HasReduction P1 Normal --- 1 skylined webkit-unassigned enrica eric kalman rniwa tony oldest_to_newest 314923 0 75119 skylined 2010-11-30 02:53:39 -0800 Created attachment 75119 Repro Repro: <body><script> with(window.getSelection()) { addRange(document.createRange()); collapseToStart(); } document.designMode = "on"; document.write('<video>'); document.execCommand("indent"); </script> id: chrome.dll!WebCore::canHaveChildrenForEditing ReadAV@NULL (4c335fdc0441ae912c5dd65199668a34) description: Attempt to read from unallocated NULL pointer+0x24 in chrome.dll!WebCore::canHaveChildrenForEditing application: Chromium 9.0.596.0 stack: chrome.dll!WebCore::canHaveChildrenForEditing chrome.dll!WebCore::CompositeEditCommand::insertNodeAt chrome.dll!WebCore::ApplyBlockElementCommand::formatSelection chrome.dll!WebCore::ApplyBlockElementCommand::doApply chrome.dll!WebCore::EditCommand::apply chrome.dll!WebCore::applyCommand chrome.dll!WebCore::executeIndent chrome.dll!WebCore::Editor::Command::execute chrome.dll!WebCore::Document::execCommand chrome.dll!WebCore::DocumentInternal::execCommandCallback chrome.dll!v8::internal::HandleApiCallHelper<...> chrome.dll!v8::internal::Builtin_HandleApiCall chrome.dll!v8::internal::Invoke chrome.dll!v8::internal::Execution::Call ... 317207 1 rniwa 2010-12-03 18:45:33 -0800 The problem is that visible start and end of the selection is null in ApplyBlockElementCommand::doApply. This possibly a bug in Position::isCandidate. 317325 2 75620 rniwa 2010-12-04 16:50:21 -0800 Created attachment 75620 somewhat simpler repro I don't know how to fix this crash. Right now, we're not allowing the first position inside body to be a candidate even if it didn't have any other candidate in the editable region at all. One way to fix this problem is to move the special case for unsplittable element in formatSelection to doApply. But this would only fix IndentOutdentCommand and FormatBlockCommand. I'm sure a similar problem exists for other editing commands as well. However, allowing the said position to be a candidate breaks so may assumptions we make in editing and causes hundreds of tests to fail / crash. 317327 3 rniwa 2010-12-04 16:53:23 -0800 After debugging for a couple of hours, I'm almost convinced that Position::atEditingBoundary is broken: // A position is considered at editing boundary if one of the following is true: // 1. It is the first position in the node and the next visually equivalent position // is non editable. // 2. It is the last position in the node and the previous visually equivalent position // is non editable. // 3. It is an editable position and both the next and previous visually equivalent // positions are both non editable. bool Position::atEditingBoundary() const { Position nextPosition = downstream(CanCrossEditingBoundary); if (atFirstEditingPositionForNode() && nextPosition.isNotNull() && !nextPosition.node()->isContentEditable()) return true; Position prevPosition = upstream(CanCrossEditingBoundary); if (atLastEditingPositionForNode() && prevPosition.isNotNull() && !prevPosition.node()->isContentEditable()) return true; return nextPosition.isNotNull() && !nextPosition.node()->isContentEditable() && prevPosition.isNotNull() && !prevPosition.node()->isContentEditable(); } Kalman, are you familiar with this function? This might be related to what you've been working on. 317424 4 kalman 2010-12-05 17:32:53 -0800 > Kalman, are you familiar with this function? This might be related to what you've been working on. No, not really. I haven't run into a problem with it (yet?) but I also haven't been debugging a code path that touches it afaik. 75119 2010-11-30 02:53:39 -0800 2010-11-30 02:53:39 -0800 Repro repro.html text/html 214 skylined PGJvZHk+PHNjcmlwdD4KICB3aXRoKHdpbmRvdy5nZXRTZWxlY3Rpb24oKSkgewogICAgYWRkUmFu Z2UoZG9jdW1lbnQuY3JlYXRlUmFuZ2UoKSk7CiAgICBjb2xsYXBzZVRvU3RhcnQoKTsKICB9CiAg ZG9jdW1lbnQuZGVzaWduTW9kZSA9ICJvbiI7CiAgZG9jdW1lbnQud3JpdGUoJzx2aWRlbz4nKTsK ICBkb2N1bWVudC5leGVjQ29tbWFuZCgiaW5kZW50Iik7Cjwvc2NyaXB0Pg== 75620 2010-12-04 16:50:21 -0800 2010-12-04 16:50:21 -0800 somewhat simpler repro bug50218.html text/html 181 rniwa PCFET0NUWVBFIGh0bWw+CjxodG1sPgo8Ym9keSBvbmxvYWQ9J2RvY3VtZW50LmV4ZWNDb21tYW5k KCJpbmRlbnQiKTsnPjxzY3JpcHQ+Cgp3aW5kb3cuZ2V0U2VsZWN0aW9uKCkuc2VsZWN0QWxsQ2hp bGRyZW4oZG9jdW1lbnQuYm9keSk7CmRvY3VtZW50LmRlc2lnbk1vZGUgPSAib24iOwoKPC9zY3Jp cHQ+PHZpZGVvPg==