56644 2011-03-18 07:25:50 -0700 chrome.dll!WebCore::positionAvoidingPrecedingNodes ReadAV@NULL (586c6d571697e9318ad053888f701434) 2011-04-03 08:28:29 -0700 1 1 1 Unclassified WebKit HTML Editing 528+ (Nightly build) PC Windows Vista RESOLVED FIXED P1 Normal --- 56771 1 skylined webkit-unassigned rniwa oldest_to_newest 369616 0 86162 skylined 2011-03-18 07:25:50 -0700 Created attachment 86162 Repro Chromium: http://code.google.com/p/chromium/issues/detail?id=76675 Repro: <body onload="go()"></body> <script> function go() { document.open(); document.designMode="on"; var oSelection = window.getSelection(); oSelection.setPosition(document,6); document.write("x"); document.execCommand("InsertImage"); } </script> id: chrome.dll!WebCore::positionAvoidingPrecedingNodes ReadAV@NULL (586c6d571697e9318ad053888f701434) description: Attempt to read from unallocated NULL pointer+0x24 in chrome.dll!WebCore::positionAvoidingPrecedingNodes stack: chrome.dll!WebCore::positionAvoidingPrecedingNodes chrome.dll!WebCore::ReplaceSelectionCommand::doApply chrome.dll!WebCore::EditCommand::apply chrome.dll!WebCore::applyCommand chrome.dll!WebCore::executeInsertFragment chrome.dll!WebCore::executeInsertNode chrome.dll!WebCore::executeInsertImage chrome.dll!WebCore::Editor::Command::execute chrome.dll!WebCore::Document::execCommand chrome.dll!WebCore::DocumentInternal::execCommandCallback chrome.dll!v8::internal::HandleApiCallHelper<...> chrome.dll!v8::internal::Builtin_HandleApiCall chrome.dll!v8::internal::Invoke chrome.dll!v8::internal::Execution::Call ... 370974 1 rniwa 2011-03-21 15:59:49 -0700 I can't reproduce this crash on Chrome 11.0.696.12 although it hits an assertion on ToT WebKit. 374389 2 skylined 2011-03-28 03:54:10 -0700 Have you tried Chrome 12? This reproduces in 12.0.716.0 (79495) for me. 378555 3 rniwa 2011-04-03 08:28:29 -0700 Fixed in http://trac.webkit.org/changeset/82791. 86162 2011-03-18 07:25:50 -0700 2011-03-18 07:25:50 -0700 Repro repro.html text/html 269 skylined PGJvZHkgb25sb2FkPSJnbygpIj48L2JvZHk+CjxzY3JpcHQ+CiAgZnVuY3Rpb24gZ28oKSB7CiAg ICBkb2N1bWVudC5vcGVuKCk7CiAgICBkb2N1bWVudC5kZXNpZ25Nb2RlPSJvbiI7CiAgICB2YXIg b1NlbGVjdGlvbiA9IHdpbmRvdy5nZXRTZWxlY3Rpb24oKTsKICAgIG9TZWxlY3Rpb24uc2V0UG9z aXRpb24oZG9jdW1lbnQsNik7CiAgICBkb2N1bWVudC53cml0ZSgieCIpOwogICAgZG9jdW1lbnQu ZXhlY0NvbW1hbmQoIkluc2VydEltYWdlIik7CiAgfQo8L3NjcmlwdD4=