Bug 20482

Summary:

REGRESSION (r34342-r34367): Crash at WebCore::canHaveChildrenForEditing

Product:

WebKit

Reporter:

Robert Blaut <webkit>

Component:

HTML Editing

Assignee:

Nobody <webkit-unassigned>

Status:

RESOLVED FIXED

Severity:

Major

CC:

ddkilzer, gsherloc, justin.garcia, tom

Priority:

Keywords:

HasReduction, Regression

Version:

528+ (Nightly build)

Hardware:

Mac

OS:

OS X 10.5

URL:

http://my.opera.com/ODIN/blog/lovely-break-css-working-group

Attachments:

Description	Flags
crash log	none
reduction	none

Robert Blaut

Reported 2008-08-22 01:24:41 PDT

Reproducible crash on http://my.opera.com/ODIN/blog/lovely-break-css-working-group after using ctrl + cmd + d (Lookup in Dictionary) 1) Go to http://my.opera.com/ODIN/blog/lovely-break-css-working-group 2) Place cursor on "lovely" word 3) Press ctrl + cmd + d 4) Webkit r35844 for Mac OS X crashes Note: if it doesn't crash for the first time, use shortcut one more time.

Attachments
crash log (24.25 KB, text/plain) 2008-08-22 01:25 PDT, Robert Blaut	no flags	Details
reduction (349 bytes, text/html) 2008-09-20 17:07 PDT, Gavin Sherlock	no flags	Details
View All Add attachment proposed patch, testcase, etc.

Robert Blaut

Comment 1 2008-08-22 01:25:56 PDT

Created attachment 22932 [details] crash log

Tom Ierna

Comment 2 2008-09-20 08:37:08 PDT

I'm seeing this bug as well, at this URL: http://www.metafilter.com/74881/Palin-pancakes-and-the-straight-talk-express#2265981

Gavin Sherlock

Comment 3 2008-09-20 09:02:13 PDT

Took me about a dozen tries to reproduce it, but I see the crash also. Am unable to reproduce in Safari 3.1.2 after trying for a while, so presume this is a regression.

Gavin Sherlock

Comment 4 2008-09-20 09:23:05 PDT

Easier steps to reproduce: 1) Go to http://my.opera.com/ODIN/blog/lovely-break-css-working-group 2) Place cursor on "lovely" word 3) Press ctrl + cmd + d 4) If it hasn't crashed, place cursor on "lunch" 5) Press ctrl + cmd + d

Gavin Sherlock

Comment 5 2008-09-20 09:23:43 PDT

Regressed between r34342 and r34367 ( don't have privileges to change the title).

Gavin Sherlock

Comment 6 2008-09-20 09:28:08 PDT

I suspect: http://trac.webkit.org/changeset/34344 though am not sure.

Gavin Sherlock

Comment 7 2008-09-20 17:07:43 PDT

Created attachment 23617 [details] reduction 1) Place cursor on "One" word 2) Press ctrl + cmd + d 3) Place cursor on "Two" 4) Press ctrl + cmd + d Crash! I don't seem to be able to reduce any further.

David Kilzer (:ddkilzer)

Comment 8 2008-11-29 05:28:18 PST

I don't see this crash anymore with WebKit nightly build r38826 on Mac OS X 10.4.11 (8S165) with Safari 3.2. Can anyone else still reproduce it?

Gavin Sherlock

Comment 9 2008-11-29 07:59:41 PST

r38826 also doesn't crash for me on 10.5.5 with Safari 3.2. It would be nice to know what changeset fixed this, and to at least have a manual test to prevent it regressing.

David Kilzer (:ddkilzer)

Comment 10 2008-11-29 11:18:20 PST

Running bisect-builds to determine when this was fixed.

David Kilzer (:ddkilzer)

Comment 11 2008-11-29 11:21:52 PST

(In reply to comment #10) > Running bisect-builds to determine when this was fixed. Fails: r38297 Works: r38377

David Kilzer (:ddkilzer)

Comment 12 2008-11-29 11:28:27 PST

(In reply to comment #11) > (In reply to comment #10) > > Running bisect-builds to determine when this was fixed. > Fails: r38297 Works: r38377 I suspect r38304 fixed this. http://trac.webkit.org/changeset/38304 See also Bug 22160.

Note You need to log in before you can comment on or make changes to this bug.