Summary: | Crash when dragging selection over absolutely positioned generated content on block element | ||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Elliott Sprehn <esprehn> | ||||||||||
Component: | Layout and Rendering | Assignee: | Nobody <webkit-unassigned> | ||||||||||
Status: | RESOLVED FIXED | ||||||||||||
Severity: | Normal | CC: | bdakin, mitz | ||||||||||
Priority: | P1 | Keywords: | HasReduction, InRadar | ||||||||||
Version: | 523.x (Safari 3) | ||||||||||||
Hardware: | Mac | ||||||||||||
OS: | OS X 10.4 | ||||||||||||
Attachments: |
|
Description
Elliott Sprehn
2007-04-30 23:49:50 PDT
Created attachment 14285 [details]
Webkit Nightly Crash Log
Created attachment 14286 [details]
Safari 2 Crash Log
Created attachment 14287 [details]
Test Case
In the text case click below the red square and hold so you have a text selection I-beam and then drag over the red box up to the text.
This will cause the browser to crash.
This occurs with both :before and :after. Neat bug. This was printed to the console: ERROR: No parent frame in transitionToCommitted:, FrameLoadTypeInternal This assert demonstrates the real problem here: Index: rendering/RenderLayer.cpp =================================================================== --- rendering/RenderLayer.cpp (revision 21246) +++ rendering/RenderLayer.cpp (working copy) @@ -1557,6 +1557,7 @@ // Now determine if the result is inside an anchor; make sure an image map wins if // it already set URLElement and only use the innermost. Node* node = result.innerNode(); + ASSERT(!!insideLayer == !!node); while (node) { // for imagemaps, URLElement is the associated area element not the image itself if (node->isLink() && !result.URLElement() && !node->hasTagName(imgTag)) I'm just not sure how to fix it yet. Created attachment 14348 [details]
Return the enclosing element for positioned generated content
Comment on attachment 14348 [details]
Return the enclosing element for positioned generated content
r=me
Committed revision 21276. |