Bug 10139

Summary: REGRESSION: Reproducible crash when selecting a popup/button with ::selection pseudostyle
Product: WebKit Reporter: Romain BOSSUT <romain.bossut>
Component: FormsAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Major CC: adele, jonathanjohnsson, mitz
Priority: P1 Keywords: HasReduction, InRadar, Regression
Version: 420+   
Hardware: Mac   
OS: OS X 10.4   
URL: http://paularmstrongdesigns.com/examples/css/awesome-form.html
Attachments:
Description Flags
Reduction (will crash)
none
Crash Log none

Romain BOSSUT
Reported 2006-07-27 23:51:30 PDT
When you select the text of this page : http://paularmstrongdesigns.com/examples/css/awesome-form.html (You can test with cmd-a) Safari quit unexpectly. The bug seems to be due to the form.
Attachments
Reduction (will crash) (481 bytes, text/html)
2006-07-28 02:34 PDT, mitz 		no flags
Details
Crash Log (24.87 KB, text/plain)
2006-11-06 19:27 PST, Stephanie Lewis 		no flags
Details
View All Add attachment proposed patch, testcase, etc.
mitz
Comment 1 2006-07-28 02:34:22 PDT
Created attachment 9735 [details] Reduction (will crash)
mitz
Comment 2 2006-07-28 03:08:14 PDT
The crash is due to elemen() being 0 here in RenderObject::getPseudoStyle(): Node* node = element(); if (isText()) node = element()->parentNode(); The popup's "button text" is an anonymous RenderText, whose RenderStyle is copied from the RenderMenuList. You can add special-case code in getPseudoStyle() for this. I wonder if there's a more elegeant solution.
mitz
Comment 3 2006-10-05 10:23:51 PDT
*** Bug 11174 has been marked as a duplicate of this bug. ***
mitz
Comment 4 2006-10-05 10:25:16 PDT
<input type="button"> has the same bug (originally reported in bug 11174).
Stephanie Lewis
Comment 5 2006-11-06 19:27:44 PST
Created attachment 11410 [details] Crash Log added crash log radar 4823028
Dave Hyatt
Comment 6 2006-12-14 23:15:02 PST
Should be fine to just band-aid this with a null check for now.
Adele Peterson
Comment 7 2007-01-17 14:08:42 PST
Committed revision 18915.
Note You need to log in before you can comment on or make changes to this bug.