77218 2012-01-27 07:18:11 -0800 NULL ptr in WebCore::Range::getBorderAndTextQuads 2012-04-30 15:51:05 -0700 1 1 1 Unclassified WebKit DOM 528+ (Nightly build) PC Windows Vista RESOLVED FIXED P1 Normal --- 1 skylined rniwa adamk darin eric kling koivisto rniwa webkit.review.bot oldest_to_newest 544054 0 skylined 2012-01-27 07:18:11 -0800 Detailed report: https://cluster-fuzz.appspot.com/testcase?key=15992978 Uploader: skylined@chromium.org Crash Type: UNKNOWN Crash Address: 0x000000000024 Crash State: - crash stack - WebCore::Range::getBorderAndTextQuads WebCore::Range::boundingRect WebCore::Range::getBoundingClientRect Regressed: https://cluster-fuzz.appspot.com/revisions?range=108839:108881 Minimized Testcase (1.41 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94sYtyY7GIxx6IaywhcjimvW1hTKDKblRUvsoU_E-sx8mxItU3CF_jlHEjEXOcSHtmTFe8pDGTsyjWWbllly3tEyYJmA9eIInB-90Z3cIcfU8oY935-hLScNr7EbUCRsFBWHrp6QmbtpR9NJgNeo1SvnfJnXw 612925 1 rniwa 2012-04-30 14:01:39 -0700 Simplified reduction: <!DOCTYPE html> <html xmlns="http://www.w3.org/1999/xhtml"> <style></style> <script> <![CDATA[ window.onload = function () { document.execCommand("SelectAll", false); var range = null; document.addEventListener("DOMNodeRemovedFromDocument", function () { range = getSelection().getRangeAt(0); },true); getSelection().getRangeAt(0).extractContents(); range.getBoundingClientRect(); } ]]> </script> <input/> </html> 612961 2 139520 rniwa 2012-04-30 14:33:21 -0700 Created attachment 139520 Fixes the crash 612998 3 139520 eric 2012-04-30 15:11:37 -0700 Comment on attachment 139520 Fixes the crash Seems totally reasonable. 613027 4 139520 webkit.review.bot 2012-04-30 15:51:00 -0700 Comment on attachment 139520 Fixes the crash Clearing flags on attachment: 139520 Committed r115686: <http://trac.webkit.org/changeset/115686> 613028 5 webkit.review.bot 2012-04-30 15:51:05 -0700 All reviewed patches have been landed. Closing bug. 139520 2012-04-30 14:33:21 -0700 2012-04-30 15:51:00 -0700 Fixes the crash bug-77218-20120430143529.patch text/plain 4267 rniwa SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDExNTY2NykKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDIzIEBACisyMDEyLTA0LTMwICBSeW9zdWtl IE5pd2EgIDxybml3YUB3ZWJraXQub3JnPgorCisgICAgICAgIE5VTEwgcHRyIGluIFdlYkNvcmU6 OlJhbmdlOjpnZXRCb3JkZXJBbmRUZXh0UXVhZHMKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtp dC5vcmcvc2hvd19idWcuY2dpP2lkPTc3MjE4CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZ IChPT1BTISkuCisKKyAgICAgICAgVGhlIGNyYXNoIHdhcyBjYXVzZWQgYnkgYSBtYWxmb3JtZWQg cmFuZ2Ugb2J0YWluZWQgd2l0aGluIGFuIGV2ZW50IGhhbmRsZXIgb2YgbXV0YXRpb24gZXZlbnRz CisgICAgICAgIChET01Ob2RlUmVtb3ZlZEZyb21Eb2N1bWVudCkuIEJlY2F1c2UgdGhpcyByYW5n ZSB3YXNuJ3QgdXBkYXRlZCBwZXIgbm9kZSByZW1vdmFsLCByYW5nZSBmdW5jdGlvbnMKKyAgICAg ICAgZW5kIHVwIG5vdCBiZWhhdmluZyB3ZWxsLgorCisgICAgICAgIEZpeGVkIHRoZSBidWcgYnkg Y2hhbmdpbmcgdGhlIG9yZGVyIG9mIHRoZSBub3RpZmljYXRpb25zIGluIENvbnRhaW5lck5vZGU6 OndpbGxSZW1vdmVDaGlsZC4KKyAgICAgICAgV2Ugbm93IGZpcmUgbXV0YXRpb24gZXZlbnRzIGZp cnN0IGJlZm9yZSB1cGRhdGluZyByYW5nZXMgc28gdGhhdCBhbnkgcmFuZ2UgY3JlYXRlZCBpbnNp ZGUgdGhvc2UKKyAgICAgICAgZXZlbnQgaGFuZGxlcnMgY2FuIGFsc28gYmUgdXBkYXRlZCBwcmlv ciB0byB0aGUgYWN0dWFsIG5vZGUgcmVtb3ZhbC4KKworICAgICAgICBUZXN0OiBmYXN0L2RvbS9S YW5nZS9yYW5nZS1jcmVhdGVkLWluLW11dGF0aW9uLWV2ZW50LWNyYXNoLnhodG1sCisKKyAgICAg ICAgKiBkb20vQ29udGFpbmVyTm9kZS5jcHA6CisgICAgICAgIChXZWJDb3JlOjp3aWxsUmVtb3Zl Q2hpbGQpOgorCiAyMDEyLTA0LTI5ICBTYW0gV2VpbmlnICA8c2FtQHdlYmtpdC5vcmc+CiAKICAg ICAgICAgUmVtb3ZlIEJsb2JCdWlsZGVyCkluZGV4OiBTb3VyY2UvV2ViQ29yZS9kb20vQ29udGFp bmVyTm9kZS5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dlYkNvcmUvZG9tL0NvbnRhaW5lck5v ZGUuY3BwCShyZXZpc2lvbiAxMTU0NjYpCisrKyBTb3VyY2UvV2ViQ29yZS9kb20vQ29udGFpbmVy Tm9kZS5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTMyOCwxMSArMzI4LDggQEAgdm9pZCBDb250YWlu ZXJOb2RlOjp3aWxsUmVtb3ZlKCkKIAogc3RhdGljIHZvaWQgd2lsbFJlbW92ZUNoaWxkKE5vZGUq IGNoaWxkKQogewotICAgIC8vIHVwZGF0ZSBhdXhpbGlhcnkgZG9jIGluZm8gKGUuZy4gaXRlcmF0 b3JzKSB0byBub3RlIHRoYXQgbm9kZSBpcyBiZWluZyByZW1vdmVkCi0gICAgY2hpbGQtPmRvY3Vt ZW50KCktPm5vZGVXaWxsQmVSZW1vdmVkKGNoaWxkKTsKLQotICAgIC8vIGZpcmUgcmVtb3ZlZCBm cm9tIGRvY3VtZW50IG11dGF0aW9uIGV2ZW50cy4KICAgICBkaXNwYXRjaENoaWxkUmVtb3ZhbEV2 ZW50cyhjaGlsZCk7CisgICAgY2hpbGQtPmRvY3VtZW50KCktPm5vZGVXaWxsQmVSZW1vdmVkKGNo aWxkKTsgLy8gZS5nLiBtdXRhdGlvbiBldmVudCBsaXN0ZW5lciBjYW4gY3JlYXRlIGEgbmV3IHJh bmdlLgogICAgIGNoaWxkLT53aWxsUmVtb3ZlKCk7CiB9CiAKSW5kZXg6IExheW91dFRlc3RzL0No YW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cJKHJldmlzaW9uIDEx NTY2NykKKysrIExheW91dFRlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsx LDE2IEBACisyMDEyLTA0LTMwICBSeW9zdWtlIE5pd2EgIDxybml3YUB3ZWJraXQub3JnPgorCisg ICAgICAgIE5VTEwgcHRyIGluIFdlYkNvcmU6OlJhbmdlOjpnZXRCb3JkZXJBbmRUZXh0UXVhZHMK KyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTc3MjE4CisK KyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgQWRkIGEgcmVn cmVzc2lvbiB0ZXN0LiBXZSB1c2UgYWxlcnQgaGVyZSBpbnN0ZWFkIG9mIGlubmVySFRNTCwgdGV4 dENvbnRlbnQsIGV0Yy4uLgorICAgICAgICBiZWNhdXNlIGRvY3VtZW50IGVsZW1lbnQgaXMgbm8g bG9uZ2VyIHdlbGwtZm9ybWVkIGF0IHRoZSBlbmQgb2YgdGhlIHRlc3QuCisKKyAgICAgICAgKiBm YXN0L2RvbS9SYW5nZS9yYW5nZS1jcmVhdGVkLWluLW11dGF0aW9uLWV2ZW50LWNyYXNoLWV4cGVj dGVkLnR4dDogQWRkZWQuCisgICAgICAgICogZmFzdC9kb20vUmFuZ2UvcmFuZ2UtY3JlYXRlZC1p bi1tdXRhdGlvbi1ldmVudC1jcmFzaC54aHRtbDogQWRkZWQuCisKIDIwMTItMDQtMzAgIFNhbSBX ZWluaWcgIDxzYW1Ad2Via2l0Lm9yZz4KIAogICAgICAgICBSZW1vdmUgQmxvYkJ1aWxkZXIKSW5k ZXg6IExheW91dFRlc3RzL2Zhc3QvZG9tL1JhbmdlL3JhbmdlLWNyZWF0ZWQtaW4tbXV0YXRpb24t ZXZlbnQtY3Jhc2gtZXhwZWN0ZWQudHh0Cj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL2Zhc3Qv ZG9tL1JhbmdlL3JhbmdlLWNyZWF0ZWQtaW4tbXV0YXRpb24tZXZlbnQtY3Jhc2gtZXhwZWN0ZWQu dHh0CShyZXZpc2lvbiAwKQorKysgTGF5b3V0VGVzdHMvZmFzdC9kb20vUmFuZ2UvcmFuZ2UtY3Jl YXRlZC1pbi1tdXRhdGlvbi1ldmVudC1jcmFzaC1leHBlY3RlZC50eHQJKHJldmlzaW9uIDApCkBA IC0wLDAgKzEsNSBAQAorQUxFUlQ6IFRoaXMgdGVzdCBjYWxscyBnZXRCb3VuZGluZ0NsaWVudFJl Y3Qgb24gYSByYW5nZSBvYnRhaW5lZCBpbnNpZGUgYSBtdXRhdGlvbiBldmVudCBsaXN0ZW5lci4K K1RoZSB0ZXN0IHBhc3NlcyBpZiBXZWJLaXQgZG9lc24ndCBjcmFzaC4KKworUEFTUy4KKwpJbmRl eDogTGF5b3V0VGVzdHMvZmFzdC9kb20vUmFuZ2UvcmFuZ2UtY3JlYXRlZC1pbi1tdXRhdGlvbi1l dmVudC1jcmFzaC54aHRtbAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9mYXN0L2RvbS9SYW5n ZS9yYW5nZS1jcmVhdGVkLWluLW11dGF0aW9uLWV2ZW50LWNyYXNoLnhodG1sCShyZXZpc2lvbiAw KQorKysgTGF5b3V0VGVzdHMvZmFzdC9kb20vUmFuZ2UvcmFuZ2UtY3JlYXRlZC1pbi1tdXRhdGlv bi1ldmVudC1jcmFzaC54aHRtbAkocmV2aXNpb24gMCkKQEAgLTAsMCArMSwzMSBAQAorPCFET0NU WVBFIGh0bWw+Cis8aHRtbCB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMTk5OS94aHRtbCI+Cis8 c3R5bGU+PC9zdHlsZT4KKzxzY3JpcHQ+Cis8IVtDREFUQVsKKword2luZG93Lm9ubG9hZCA9IGZ1 bmN0aW9uICgpIHsKKyAgICBkb2N1bWVudC5leGVjQ29tbWFuZCgiU2VsZWN0QWxsIiwgZmFsc2Up OworCisgICAgdmFyIHJhbmdlID0gbnVsbDsKKworICAgIGRvY3VtZW50LmFkZEV2ZW50TGlzdGVu ZXIoIkRPTU5vZGVSZW1vdmVkRnJvbURvY3VtZW50IiwgZnVuY3Rpb24gKCkgeworICAgICAgICBy YW5nZSA9IGdldFNlbGVjdGlvbigpLmdldFJhbmdlQXQoMCk7CisgICAgfSx0cnVlKTsKKworICAg IGdldFNlbGVjdGlvbigpLmdldFJhbmdlQXQoMCkuZXh0cmFjdENvbnRlbnRzKCk7CisgICAgcmFu Z2UuZ2V0Qm91bmRpbmdDbGllbnRSZWN0KCk7CisKKyAgICBpZiAod2luZG93LmxheW91dFRlc3RD b250cm9sbGVyKQorICAgICAgICBsYXlvdXRUZXN0Q29udHJvbGxlci5kdW1wQXNUZXh0KCk7CisK KyAgICBhbGVydCgiVGhpcyB0ZXN0IGNhbGxzIGdldEJvdW5kaW5nQ2xpZW50UmVjdCBvbiBhIHJh bmdlIG9idGFpbmVkIGluc2lkZSBhIG11dGF0aW9uIGV2ZW50IGxpc3RlbmVyLlxuIgorICAgICsg IlRoZSB0ZXN0IHBhc3NlcyBpZiBXZWJLaXQgZG9lc24ndCBjcmFzaC5cblxuIgorICAgICsgIlBB U1MuIik7Cit9CisKK11dPgorPC9zY3JpcHQ+Cis8aW5wdXQvPgorPC9odG1sPgorCg==