7398 2006-02-20 22:58:03 -0800 Crash in setFocusNode if the old focus node has been detached 2006-02-20 23:59:30 -0800 1 1 1 Unclassified WebKit Layout and Rendering 420+ Mac OS X 10.4 RESOLVED DUPLICATE 7363 P2 Major --- 1 Graham.Dennis webkit-unassigned mitz oldest_to_newest 33563 0 Graham.Dennis 2006-02-20 22:58:03 -0800 While running Sandvox with the latest WebKit ToT, if one deletes all the text in the site sub-title or 'parting words' editable divs, then the editing delegate (in Sandvox) removes the text element (it becomes detached) before setFocusNode() is called. When setFocusNode is called, there is a crash caused by the assumption that if the node exists, and it isn't currently being detached, that is must have a renderer. In this case, as it has been detached, it no longer has a renderer. I have a patch which I'll attach. The appropriate part of the crash report is below: Exception: EXC_BAD_ACCESS (0x0001) Codes: KERN_PROTECTION_FAILURE (0x0002) at 0x00000000 Thread 0 Crashed: 0 com.apple.WebCore 0x019bcb50 WebCore::DocumentImpl::setFocusNode(KXMLCore::PassRefPtr<WebCore::NodeImpl>) + 400 (DocumentImpl.cpp:2058) 1 com.apple.WebCore 0x019b53a8 WebCore::FrameView::dispatchMouseEvent(WebCore::AtomicString const&, WebCore::NodeImpl*, bool, int, QMouseEvent*, bool, int) + 1208 (FrameView.cpp:1038) 33564 1 6637 Graham.Dennis 2006-02-20 22:59:46 -0800 Created attachment 6637 patch This patch seems to fix the bug for me. 33565 2 6637 darin 2006-02-20 23:02:17 -0800 Comment on attachment 6637 patch Patch looks good. We need a layout test for regression-testing purposes and a change log entry. Also, did you run all the other layout tests to check that this didn't break anything? 33568 3 mitz 2006-02-20 23:06:27 -0800 Is this a duplicate of bug 7363? 33581 4 Graham.Dennis 2006-02-20 23:59:30 -0800 The crash occurs on the same line as 7363, but this patch won't fix 7363 as in this case, the node is detached and so doesn't have a renderer. In the other case, the node is attached but still doesn't have a renderer. *** This bug has been marked as a duplicate of 7363 *** 6637 2006-02-20 22:59:46 -0800 2006-02-20 23:02:17 -0800 patch setFocusNodeCrash.diff text/plain 597 Graham.Dennis SW5kZXg6IFdlYkNvcmUvZG9tL0RvY3VtZW50SW1wbC5jcHAKPT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gV2ViQ29y ZS9kb20vRG9jdW1lbnRJbXBsLmNwcAkocmV2aXNpb24gMTI5MDMpCisrKyBXZWJDb3JlL2RvbS9E b2N1bWVudEltcGwuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0yMDQ3LDcgKzIwNDcsNyBAQCBib29s IERvY3VtZW50SW1wbDo6c2V0Rm9jdXNOb2RlKFBhc3NSZWZQCiAgICAgY2xlYXJTZWxlY3Rpb25J Zk5lZWRlZChuZXdGb2N1c05vZGUuZ2V0KCkpOwogCiAgICAgLy8gUmVtb3ZlIGZvY3VzIGZyb20g dGhlIGV4aXN0aW5nIGZvY3VzIG5vZGUgKGlmIGFueSkKLSAgICBpZiAob2xkRm9jdXNOb2RlICYm ICFvbGRGb2N1c05vZGUtPm1faW5EZXRhY2gpIHsgCisgICAgaWYgKG9sZEZvY3VzTm9kZSAmJiBv bGRGb2N1c05vZGUtPmF0dGFjaGVkKCkgJiYgIW9sZEZvY3VzTm9kZS0+bV9pbkRldGFjaCkgeyAK ICAgICAgICAgaWYgKG9sZEZvY3VzTm9kZS0+YWN0aXZlKCkpCiAgICAgICAgICAgICBvbGRGb2N1 c05vZGUtPnNldEFjdGl2ZShmYWxzZSk7CiAK