Bug 137961

Summary:

Crash in WebCore::Node::getFlag

Product:

WebKit

Reporter:

Renata Hodovan <rhodovan.u-szeged>

Component:

DOM

Assignee:

Csaba Osztrogonác <ossy>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

commit-queue, darin, enrica, koivisto, ossy, rniwa, sam

Priority:

Version:

528+ (Nightly build)

Hardware:

Unspecified

OS:

Unspecified

Bug Depends on:

Bug Blocks:

116980

Attachments:

Description	Flags
Test case	none
WIP patch	none
Patch	none

Description Renata Hodovan 2014-10-22 08:37:09 PDT

Created attachment 240275 [details]
Test case

The crashing test:

<!DOCTYPE html>
<html contenteditable>
<head>
<script>
function test() {
    document.execCommand("selectAll", false, null);
    document.execCommand("createlink", true, "http://www.example.com");
    document.execCommand("removeFormat", false, null);
}
</script>
<style>
* {
    display:table-row-group;
}
</style>
</head>
<body onload='test()' hidden>


Backtrace:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fff98c1f700 (LWP 22759)]
0x00007ffff2771463 in WebCore::Node::getFlag (this=0x0, mask=WebCore::Node::IsTextFlag) at ../../Source/WebCore/dom/Node.h:630
630	    bool getFlag(NodeFlags mask) const { return m_nodeFlags & mask; }
#0  0x00007ffff2771463 in WebCore::Node::getFlag (this=0x0, mask=WebCore::Node::IsTextFlag) at ../../Source/WebCore/dom/Node.h:630
#1  0x00007ffff291d1d7 in WebCore::Node::isTextNode (this=0x0) at ../../Source/WebCore/dom/Node.h:228
#2  0x00007ffff291d423 in WebCore::firstPositionInNode (anchorNode=0x0) at ../../Source/WebCore/dom/Position.h:306
#3  0x00007ffff3149f87 in WebCore::ApplyStyleCommand::applyBlockStyle (this=0x8ff570, style=0x675f90) at ../../Source/WebCore/editing/ApplyStyleCommand.cpp:260
#4  0x00007ffff3149c59 in WebCore::ApplyStyleCommand::doApply (this=0x8ff570) at ../../Source/WebCore/editing/ApplyStyleCommand.cpp:214
#5  0x00007ffff315c47a in WebCore::CompositeEditCommand::applyCommandToComposite (this=0x804720, prpCommand=...) at ../../Source/WebCore/editing/CompositeEditCommand.cpp:277
#6  0x00007ffff31cb7b8 in WebCore::RemoveFormatCommand::doApply (this=0x804720) at ../../Source/WebCore/editing/RemoveFormatCommand.cpp:93
#7  0x00007ffff315c1e1 in WebCore::CompositeEditCommand::apply (this=0x804720) at ../../Source/WebCore/editing/CompositeEditCommand.cpp:226
#8  0x00007ffff315bf97 in WebCore::applyCommand (command=...) at ../../Source/WebCore/editing/CompositeEditCommand.cpp:183
#9  0x00007ffff31888e4 in WebCore::Editor::removeFormattingAndStyle (this=0x8c33c0) at ../../Source/WebCore/editing/Editor.cpp:891
#10 0x00007ffff31a1162 in WebCore::executeRemoveFormat (frame=...) at ../../Source/WebCore/editing/EditorCommand.cpp:983
#11 0x00007ffff31a2fd9 in WebCore::Editor::Command::execute (this=0x7fffffffc6a0, parameter=..., triggeringEvent=0x0) at ../../Source/WebCore/editing/EditorCommand.cpp:1726
#12 0x00007ffff30343f8 in WebCore::Document::execCommand (this=0xa7da90, commandName=..., userInterface=false, value=...) at ../../Source/WebCore/dom/Document.cpp:4373
#13 0x00007ffff402b8cd in WebCore::jsDocumentPrototypeFunctionExecCommand (exec=0x7fffffffc7a0) at DerivedSources/WebCore/JSDocument.cpp:4526
#14 0x00007fff9a8f40b4 in ?? ()
#15 0x00007fffffffc800 in ?? ()
#16 0x00007fffeda92edb in llint_entry () from /home/reni/data/REPOS/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18

Comment 1 Darin Adler 2014-10-22 20:02:27 PDT

The fix for this is in ApplyStyleCommand::applyBlockStyle:

    if (!scope)
        return;

This needs to be done just after scope is initialized.

Comment 2 Csaba Osztrogonác 2014-11-07 04:49:44 PST

Created attachment 241172 [details]
WIP patch

seems working locally, WIP patch for EWS

Comment 3 Csaba Osztrogonác 2014-11-10 04:44:22 PST

Created attachment 241285 [details]
Patch

Comment 4 WebKit Commit Bot 2014-11-10 08:20:46 PST

Comment on attachment 241285 [details]
Patch

Clearing flags on attachment: 241285

Committed r175809: <http://trac.webkit.org/changeset/175809>

Comment 5 WebKit Commit Bot 2014-11-10 08:20:50 PST

All reviewed patches have been landed.  Closing bug.