Bug 30314

Summary: Two ASSERTS and a NULL ptr read AV in WebCore::Node::document
Product: WebKit Reporter: Berend-Jan Wever <skylined>
Component: HTML EditingAssignee: Nobody <webkit-unassigned>
Status: RESOLVED WORKSFORME    
Severity: Normal CC: enrica, eric, justin.garcia, ojan, rniwa, tony
Priority: P1 Keywords: HasReduction, InRadar
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
URL: http://skypher.com/SkyLined/Repro/WebKit/Bug%2030314%20-%20Two%20ASSERTS%20and%20a%20NULL%20ptr%20read%20AV%20in%20WebCore..Node..document/repro.html
Attachments:
Description Flags
Repro none

Berend-Jan Wever
Reported 2009-10-12 14:43:35 PDT
Created attachment 41060 [details] Repro Repro: <HTML> <BODY onload="go()"></BODY> <SCRIPT> function go() { document.execCommand("selectall"); document.designMode="on"; document.execCommand("insertimage"); document.execCommand("indent"); setTimeout(go, 1); } </SCRIPT> </HTML> 1st ASSERT: "start == end" in WebCore::CompositeEditCommand::splitTreeToNode PassRefPtr<Node> CompositeEditCommand::splitTreeToNode(Node* start, Node* end, bool splitAncestor) { ASSERT(start != end); 2nd ASSERT: "this == 0" and NULL ptr read AV in WebCore::Node::document Document* document() const { ASSERT(this); ASSERT(m_document || (nodeType() == DOCUMENT_TYPE_NODE && !inDocument()));
Attachments
Repro (283 bytes, text/html)
2009-10-12 14:43 PDT, Berend-Jan Wever 		no flags
Details
View All Add attachment proposed patch, testcase, etc.
Mark Rowe (bdash)
Comment 1 2009-10-12 15:55:47 PDT
The GoogleBug keyword indicates that this affects a Google web property. Did you mean to add that keyword?
Mark Rowe (bdash)
Comment 2 2009-10-12 16:00:27 PDT
<rdar://problem/7296904>
Berend-Jan Wever
Comment 3 2009-10-12 16:02:01 PDT
Sorry, could you define "Google web property"? I used the label because this affects Google Chrome. I have been filing all WebKit bugs with this label if they affect Google Chrome for a long time - is that incorrect?
Mark Rowe (bdash)
Comment 4 2009-10-12 16:33:43 PDT
The keyword is intended to indicate that the bug impacts a Google site like Gmail, Google Docs, etc.
Ryosuke Niwa
Comment 5 2010-08-11 18:20:03 PDT
This bug is caused by indentIntoBlockquote's trying to insert a blockquote before body element. This might be an issue with startOfParagraph because it's returning the body element when VS points at an image, which is the first child of body. This causes outerBlock = start.node() = nodeToSplitTo to be the root editable element. Obviously, inserting an element before the root editable root isn't right, not to mention before the body element. Justin, Enrica, Eric: Do you know if startOfParagraph should ever return body? I don't think this makes any sense.
Ryosuke Niwa
Comment 6 2012-05-25 00:11:58 PDT
This crash no longer reproduces.
Note You need to log in before you can comment on or make changes to this bug.