Bug 13557 – Crash when dragging selection over absolutely positioned generated content on block element

• Component: Layout and Rendering
• Status: RESOLVED FIXED

[Elliott Sprehn]

If you drag the selection box over the absolutely positioned generated content of a block element Webkit crashes.

Reproducible with Safari 2 and latest Webkit Nightly (Mon Apr 30 11:37:42 GMT 2007).

Note that the crash reasons for Safari and Webkit are different, but the same actions can be taken to cause the crash.

[Elliott Sprehn]

Created attachment 14285 [details]
Webkit Nightly Crash Log

[Elliott Sprehn]

Created attachment 14286 [details]
Safari 2 Crash Log

[Elliott Sprehn]

Created attachment 14287 [details]
Test Case

In the text case click below the red square and hold so you have a text selection I-beam and then drag over the red box up to the text.

This will cause the browser to crash.

[Elliott Sprehn]

This occurs with both :before and :after.

[Alexey Proskuryakov]

Confirmed with r21199.

[Eric Seidel (no email)]

Neat bug.  This was printed to the console:

ERROR: No parent frame in transitionToCommitted:, FrameLoadTypeInternal

[Eric Seidel (no email)]

This assert demonstrates the real problem here:

Index: rendering/RenderLayer.cpp
===================================================================
--- rendering/RenderLayer.cpp   (revision 21246)
+++ rendering/RenderLayer.cpp   (working copy)
@@ -1557,6 +1557,7 @@
     // Now determine if the result is inside an anchor; make sure an image map wins if
     // it already set URLElement and only use the innermost.
     Node* node = result.innerNode();
+    ASSERT(!!insideLayer == !!node);
     while (node) {
         // for imagemaps, URLElement is the associated area element not the image itself
         if (node->isLink() && !result.URLElement() && !node->hasTagName(imgTag))

I'm just not sure how to fix it yet.

[Darin Adler]

<rdar://problem/5183693>

Created attachment 14348 [details]
Return the enclosing element for positioned generated content

[Dave Hyatt]

Comment on attachment 14348 [details]
Return the enclosing element for positioned generated content

r=me

[Alexey Proskuryakov]

Committed revision 21276.