Summary: | Nullptr crash in CompositeEditCommand::splitTreeToNode via InsertParagraphSeparatorCommand::doApply | ||||||||
---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Ryosuke Niwa <rniwa> | ||||||
Component: | HTML Editing | Assignee: | Frédéric Wang (:fredw) <fred.wang> | ||||||
Status: | RESOLVED FIXED | ||||||||
Severity: | Normal | CC: | bfulgham, cgarcia, ews-feeder, fred.wang, gpoo, product-security, rbuis, svillar, webkit-bug-importer, wenson_hsieh | ||||||
Priority: | P2 | Keywords: | InRadar | ||||||
Version: | WebKit Nightly Build | ||||||||
Hardware: | Unspecified | ||||||||
OS: | Unspecified | ||||||||
See Also: | https://bugs.webkit.org/show_bug.cgi?id=220349 | ||||||||
Bug Depends on: | |||||||||
Bug Blocks: | 224977 | ||||||||
Attachments: |
|
Description
Ryosuke Niwa
2021-06-02 00:58:42 PDT
Below is the state of the tree before it crashes, where the divs are display: table. This is fixed by attachment 430342 [details] from bug 224977. #document 0x61f00001dc80 (renderer 0x6160003ce480) HTML 0x60c0002a6880 (renderer 0x61200007da40) DIV 0x60c0002abb00 (renderer 0x61400007bc40) * #text 0x60b0000e8c70 "onload = () => { document.execCommand('SelectAll'); document.execCommand('Copy'); document.execCommand('SelectAll'); document.designMode = 'on'; document.execCommand('PasteAndMatchStyle'); };" DIV 0x60c0002b3600 (renderer 0x61400007c240) BR 0x60c0002b3900 (renderer 0x6110001d5640) BODY 0x60c0002a7600 (renderer 0x61200007e040) STYLE 0x610000024140 (renderer (nil)) #text 0x60b0000e6ee0 "\n head, script, div {\n display: table;\n }\n" Created attachment 430360 [details]
Patch
Committed r278593 (238583@main): <https://commits.webkit.org/238583@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 430360 [details]. |