Bug 42844

Summary: WebCore::Range::checkDeleteExtract ReadAV@NULL (6b8e49858d67765d88bae6e8abff48dd)
Product: WebKit Reporter: Berend-Jan Wever <skylined>
Component: HTML EditingAssignee: Nobody <webkit-unassigned>
Status: RESOLVED DUPLICATE    
Severity: Normal CC: eae, eric, rniwa
Priority: P1    
Version: 528+ (Nightly build)   
Hardware: PC   
OS: Windows Vista   
URL: http://code.google.com/p/chromium/issues/detail?id=49971
Attachments:
Description Flags
Patch to fix the issue
none
Repro with inline analysis none

Berend-Jan Wever
Reported 2010-07-22 13:21:51 PDT
Created attachment 62330 [details] Patch to fix the issue Repro and details: <html> <head> <script> function go() { prompt('Time to set breakpoint in renderer at:', 'bm chrome_*!WebCore::DOMSelection::deleteFromDocument'); selection = window.getSelection(); range = document.createRange(); selection.addRange(range); document.designMode = "on"; document.execCommand("InsertText", false, 'x'); document.open(); document.execCommand("Undo"); selection.deleteFromDocument(); // "selectedRange" is NULL in WebKit\WebCore\page\DOMSelection.cpp: // void DOMSelection::deleteFromDocument() // { // if (!m_frame) // return; // // SelectionController* selection = m_frame->selection(); // // if (selection->isNone()) // return; // // if (isCollapsed()) // selection->modify(SelectionController::AlterationExtend, SelectionController::DirectionBackward, CharacterGranularity); // // RefPtr<Range> selectedRange = selection->selection().toNormalizedRange(); // PassRefPtr<Range> VisibleSelection::toNormalizedRange() const // { // if (isNone()) // return 0; // // ExceptionCode ec = 0; // selectedRange->deleteContents(ec); // selectedRange == 0 --> KaB00m!!! } </script> </head> <body onload="go()"> </body> </html> Suggested fix: add the check below. if (selectedRange == 0) return; The above has been tested to resolve the issue, I've attached a .patch file that applies it. I'll create a test shortly.
Attachments
Patch to fix the issue (405 bytes, application/octet-stream)
2010-07-22 13:21 PDT, Berend-Jan Wever 		no flags
Details
Repro with inline analysis (1.46 KB, text/html)
2010-07-22 13:33 PDT, Berend-Jan Wever 		no flags
Details
View All Add attachment proposed patch, testcase, etc.
Berend-Jan Wever
Comment 1 2010-07-22 13:33:26 PDT
Created attachment 62332 [details] Repro with inline analysis
Emil A Eklund
Comment 2 2011-04-20 11:35:41 PDT
This appears to have been fixed by r65587, https://bugs.webkit.org/show_bug.cgi?id=44153
Ryosuke Niwa
Comment 3 2012-04-26 12:32:54 PDT
*** This bug has been marked as a duplicate of bug 44153 ***
Note You need to log in before you can comment on or make changes to this bug.