55290 2011-02-25 20:37:42 -0800 REGRESSION(r79398): Webkit crash on dojo theme tester page 2011-02-28 02:41:07 -0800 1 1 1 Unclassified WebKit HTML Editing 528+ (Nightly build) All All RESOLVED FIXED http://archive.dojotoolkit.org/nightly/dojotoolkit/dijit/themes/themeTester.html InRadar, Regression P1 Normal --- 1 priyajeet.hora rniwa ap commit-queue darin eric ojan priyajeet.hora rniwa skylined tony oldest_to_newest 358364 0 priyajeet.hora 2011-02-25 20:37:42 -0800 Browser crashes while looking at dojo theme tester. Doesn't happen in nightly release r79303. Happens in all nightly beyond that. Chromium 11.0.683.0 is also getting a renderer crash, might be due to the same. 358421 1 ap 2011-02-26 00:44:28 -0800 Confirmed with nightly r79488. Suspecting <http://trac.webkit.org/r79398>. 0 com.apple.WebCore 0x0000000100ef1e1d WebCore::Editor::selectionStartCSSPropertyValue(int) + 45 1 com.apple.WebCore 0x0000000100efdc18 WebCore::valueStyle(WebCore::Frame*, int) + 24 2 com.apple.WebCore 0x0000000100efdca6 WebCore::valueFontName(WebCore::Frame*, WebCore::Event*) + 22 3 com.apple.WebCore 0x0000000100eff1df WebCore::Editor::Command::value(WebCore::Event*) const + 111 4 com.apple.WebCore 0x0000000100e060c9 WebCore::Document::queryCommandValue(WTF::String const&) + 41 5 com.apple.WebCore 0x00000001011d8c36 WebCore::jsDocumentPrototypeFunctionQueryCommandValue(JSC::ExecState*) + 278 358422 2 ap 2011-02-26 00:44:57 -0800 <rdar://problem/9058070> 358444 3 rniwa 2011-02-26 03:18:26 -0800 (In reply to comment #1) > Confirmed with nightly r79488. Suspecting <http://trac.webkit.org/r79398>. > > 0 com.apple.WebCore 0x0000000100ef1e1d WebCore::Editor::selectionStartCSSPropertyValue(int) + 45 > 1 com.apple.WebCore 0x0000000100efdc18 WebCore::valueStyle(WebCore::Frame*, int) + 24 > 2 com.apple.WebCore 0x0000000100efdca6 WebCore::valueFontName(WebCore::Frame*, WebCore::Event*) + 22 > 3 com.apple.WebCore 0x0000000100eff1df WebCore::Editor::Command::value(WebCore::Event*) const + 111 > 4 com.apple.WebCore 0x0000000100e060c9 WebCore::Document::queryCommandValue(WTF::String const&) + 41 > 5 com.apple.WebCore 0x00000001011d8c36 WebCore::jsDocumentPrototypeFunctionQueryCommandValue(JSC::ExecState*) + 278 Oops! Yes, it's missing a null check. http://trac.webkit.org/browser/trunk/Source/WebCore/editing/Editor.cpp#L1043 RefPtr<EditingStyle> selectionStyle = selectionStartStyle(); if (!selectionStyle->style()) return String(); should be RefPtr<EditingStyle> selectionStyle = selectionStartStyle(); if (!selectionStyle || !selectionStyle->style()) return String(); instead. 358484 4 83937 rniwa 2011-02-26 06:28:12 -0800 Created attachment 83937 fixes the bug 358485 5 rniwa 2011-02-26 06:28:51 -0800 This was an embarrassing bug :( 358530 6 83937 commit-queue 2011-02-26 09:03:36 -0800 Comment on attachment 83937 fixes the bug Clearing flags on attachment: 83937 Committed r79794: <http://trac.webkit.org/changeset/79794> 358531 7 commit-queue 2011-02-26 09:03:40 -0800 All reviewed patches have been landed. Closing bug. 358949 8 rniwa 2011-02-28 02:41:07 -0800 *** Bug 55359 has been marked as a duplicate of this bug. *** 83937 2011-02-26 06:28:12 -0800 2011-02-26 09:03:36 -0800 fixes the bug bug-55290-20110226232810.patch text/plain 3504 rniwa SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDc5NzgyKQorKysgU291cmNlL1dlYkNvcmUvQ2hhbmdl TG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTggQEAKKzIwMTEtMDItMjYgIFJ5b3N1a2Ug Tml3YSAgPHJuaXdhQHdlYmtpdC5vcmc+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChP T1BTISkuCisKKyAgICAgICAgUkVHUkVTU0lPTihyNzkzOTgpOiBXZWJraXQgY3Jhc2ggb24gZG9q byB0aGVtZSB0ZXN0ZXIgcGFnZQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93 X2J1Zy5jZ2k/aWQ9NTUyOTAKKworICAgICAgICBUaGUgYnVnIHdhcyBjYXVzZWQgYnkgc2VsZWN0 aW9uU3RhcnRDU1NQcm9wZXJ0eVZhbHVlJ3Mgbm90IGNvbnNpZGVyaW5nIHRoZSBwb3NzaWJpbGl0 eQorICAgICAgICBvZiBzZWxlY3Rpb25TdGFydFN0eWxlKCkgcmV0dXJuaW5nIGEgbnVsbCBwb2lu dGVyLiBGaXhlZCBpdCBieSBhZGRpbmcgYSBudWxsIGNoZWNrLgorCisgICAgICAgIFRlc3Q6IGVk aXRpbmcvZXhlY0NvbW1hbmQvdmFsdWUtd2l0aG91dC1zZWxlY3Rpb24tY3Jhc2guaHRtbAorCisg ICAgICAgICogZWRpdGluZy9FZGl0b3IuY3BwOgorICAgICAgICAoV2ViQ29yZTo6RWRpdG9yOjpz ZWxlY3Rpb25TdGFydENTU1Byb3BlcnR5VmFsdWUpOgorCiAyMDExLTAyLTI2ICBFcmljIFNlaWRl bCAgPGVyaWNAd2Via2l0Lm9yZz4KIAogICAgICAgICBSZXZpZXdlZCBieSBNYWNpZWogU3RhY2hv d2lhay4KSW5kZXg6IFNvdXJjZS9XZWJDb3JlL2VkaXRpbmcvRWRpdG9yLmNwcAo9PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 Ci0tLSBTb3VyY2UvV2ViQ29yZS9lZGl0aW5nL0VkaXRvci5jcHAJKHJldmlzaW9uIDc5NzgxKQor KysgU291cmNlL1dlYkNvcmUvZWRpdGluZy9FZGl0b3IuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0x MDQxLDcgKzEwNDEsNyBAQCBzdGF0aWMgYm9vbCBoYXNUcmFuc3BhcmVudEJhY2tncm91bmRDb2xv CiBTdHJpbmcgRWRpdG9yOjpzZWxlY3Rpb25TdGFydENTU1Byb3BlcnR5VmFsdWUoaW50IHByb3Bl cnR5SUQpCiB7CiAgICAgUmVmUHRyPEVkaXRpbmdTdHlsZT4gc2VsZWN0aW9uU3R5bGUgPSBzZWxl Y3Rpb25TdGFydFN0eWxlKCk7Ci0gICAgaWYgKCFzZWxlY3Rpb25TdHlsZS0+c3R5bGUoKSkKKyAg ICBpZiAoIXNlbGVjdGlvblN0eWxlIHx8ICFzZWxlY3Rpb25TdHlsZS0+c3R5bGUoKSkKICAgICAg ICAgcmV0dXJuIFN0cmluZygpOwogCiAgICAgU3RyaW5nIHZhbHVlID0gc2VsZWN0aW9uU3R5bGUt PnN0eWxlKCktPmdldFByb3BlcnR5VmFsdWUocHJvcGVydHlJRCk7CkluZGV4OiBMYXlvdXRUZXN0 cy9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCShyZXZpc2lv biA3OTc4MikKKysrIExheW91dFRlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwz ICsxLDE1IEBACisyMDExLTAyLTI2ICBSeW9zdWtlIE5pd2EgIDxybml3YUB3ZWJraXQub3JnPgor CisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFJFR1JFU1NJ T04ocjc5Mzk4KTogV2Via2l0IGNyYXNoIG9uIGRvam8gdGhlbWUgdGVzdGVyIHBhZ2UKKyAgICAg ICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTU1MjkwCisKKyAgICAg ICAgQWRkZWQgYSB0ZXN0IHRvIGVuc3VyZSBXZWJLaXQgZG9lcyBub3QgY3Jhc2ggd2hlbiBxdWVy eWluZyBzdHlsZSB2YWx1ZSB3aXRob3V0IHNlbGVjdGlvbi4KKworICAgICAgICAqIGVkaXRpbmcv ZXhlY0NvbW1hbmQvdmFsdWUtd2l0aG91dC1zZWxlY3Rpb24tY3Jhc2gtZXhwZWN0ZWQudHh0OiBB ZGRlZC4KKyAgICAgICAgKiBlZGl0aW5nL2V4ZWNDb21tYW5kL3ZhbHVlLXdpdGhvdXQtc2VsZWN0 aW9uLWNyYXNoLmh0bWw6IEFkZGVkLgorCiAyMDExLTAyLTI2ICBBZGFtIEtsZWluICA8YWRhbWtA Y2hyb21pdW0ub3JnPgogCiAgICAgICAgIFJldmlld2VkIGJ5IEFkYW0gQmFydGguCkluZGV4OiBM YXlvdXRUZXN0cy9lZGl0aW5nL2V4ZWNDb21tYW5kL3ZhbHVlLXdpdGhvdXQtc2VsZWN0aW9uLWNy YXNoLWV4cGVjdGVkLnR4dAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9lZGl0aW5nL2V4ZWND b21tYW5kL3ZhbHVlLXdpdGhvdXQtc2VsZWN0aW9uLWNyYXNoLWV4cGVjdGVkLnR4dAkocmV2aXNp b24gMCkKKysrIExheW91dFRlc3RzL2VkaXRpbmcvZXhlY0NvbW1hbmQvdmFsdWUtd2l0aG91dC1z ZWxlY3Rpb24tY3Jhc2gtZXhwZWN0ZWQudHh0CShyZXZpc2lvbiAwKQpAQCAtMCwwICsxIEBACitQ QVNTIC0gV2ViS2l0IGRpZCBub3QgY3Jhc2ggd2hlbiBxdWVyeWluZyBjb21tYW5kIHZhbHVlIHdp dGhvdXQgc2VsZWN0aW9uLgpJbmRleDogTGF5b3V0VGVzdHMvZWRpdGluZy9leGVjQ29tbWFuZC92 YWx1ZS13aXRob3V0LXNlbGVjdGlvbi1jcmFzaC5odG1sCj09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRl c3RzL2VkaXRpbmcvZXhlY0NvbW1hbmQvdmFsdWUtd2l0aG91dC1zZWxlY3Rpb24tY3Jhc2guaHRt bAkocmV2aXNpb24gMCkKKysrIExheW91dFRlc3RzL2VkaXRpbmcvZXhlY0NvbW1hbmQvdmFsdWUt d2l0aG91dC1zZWxlY3Rpb24tY3Jhc2guaHRtbAkocmV2aXNpb24gMCkKQEAgLTAsMCArMSwxOSBA QAorPCFET0NUWVBFIGh0bWw+Cis8aHRtbD4KKzxib2R5PgorPHNjcmlwdD4KKworaWYgKHdpbmRv dy5sYXlvdXRUZXN0Q29udHJvbGxlcikKKyAgICBsYXlvdXRUZXN0Q29udHJvbGxlci5kdW1wQXNU ZXh0KCk7CisKK2RvY3VtZW50LmRlc2lnbk1vZGUgPSAnb24nOword2luZG93LmdldFNlbGVjdGlv bigpLnJlbW92ZUFsbFJhbmdlcygpOworZG9jdW1lbnQucXVlcnlDb21tYW5kVmFsdWUoJ2JhY2tD b2xvcicsIGZhbHNlLCBudWxsKTsKK2RvY3VtZW50LnF1ZXJ5Q29tbWFuZFZhbHVlKCdmb250U2l6 ZScsIGZhbHNlLCBudWxsKTsKK2RvY3VtZW50LnF1ZXJ5Q29tbWFuZFZhbHVlKCdmb250TmFtZScs IGZhbHNlLCBudWxsKTsKK2RvY3VtZW50LnF1ZXJ5Q29tbWFuZFZhbHVlKCdmb3JlQ29sb3InLCBm YWxzZSwgbnVsbCk7CisKK2RvY3VtZW50LndyaXRlbG4oJ1BBU1MgLSBXZWJLaXQgZGlkIG5vdCBj cmFzaCB3aGVuIHF1ZXJ5aW5nIGNvbW1hbmQgdmFsdWUgd2l0aG91dCBzZWxlY3Rpb24uJyk7Cis8 L3NjcmlwdD4KKzwvYm9keT4KKzwvaHRtbD4K