Bug 109596
| Summary: | ASSERT(extractedStyle) in ApplyStyleCommand::removeInlineStyleFromElement | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Renata Hodovan <rhodovan.u-szeged> |
| Component: | Tables | Assignee: | Nobody <webkit-unassigned> |
| Status: | RESOLVED DUPLICATE | ||
| Severity: | Normal | CC: | enrica, rniwa |
| Priority: | P2 | ||
| Version: | 528+ (Nightly build) | ||
| Hardware: | Unspecified | ||
| OS: | Linux | ||
| Bug Depends on: | |||
| Bug Blocks: | 116980 | ||
Renata Hodovan
I've got an assertion faulire in ApplyStyleCommand during HTML fuzzing:
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff418f722 in WebCore::ApplyStyleCommand::removeInlineStyleFromElement (this=0x94d820, style=0x860fd0, element=...,
mode=WebCore::ApplyStyleCommand::RemoveAlways, extractedStyle=0x0)
at /media/reni/8b40ba6d-a6c1-4266-9efc-917096aaf88d/reni/REPOS/webkit/Source/WebCore/editing/ApplyStyleCommand.cpp:879
879 ASSERT(extractedStyle);
Test:
<html>
<body>
<table>
<tr>
<td colspan=2 >Artists: <a href="#">Long chains of selectors</a></td>
</tr>
</table>
<script>
document.designMode = "on";
document.execCommand("SelectAll");
document.execCommand("CreateLink", 0, '#');
</script>
</body>
</html>
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Renata Hodovan
*** This bug has been marked as a duplicate of bug 119672 ***