Bug 48793

Summary:

Dragging and dropping into an empty document crashes WebKit

Product:

WebKit

Reporter:

Daniel Cheng <dcheng>

Component:

HTML Editing

Assignee:

Nobody <webkit-unassigned>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

morrita, rniwa, tony

Priority:

Version:

528+ (Nightly build)

Hardware:

OS:

OS X 10.5

Attachments:

Description	Flags
Patch	none
Patch	tony: review+

Daniel Cheng

Reported 2010-11-01 15:55:12 PDT

elementUnderMouse() in DragController.cpp can return null if the document is empty (see test.xhtml attached to crbug.com/61182).

Attachments
Patch (2.39 KB, patch) 2010-11-01 15:59 PDT, Daniel Cheng	no flags	Details Formatted Diff Diff
Patch (3.26 KB, patch) 2010-11-08 16:23 PST, Daniel Cheng	tony: review+	Details Formatted Diff Diff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.

Daniel Cheng

Comment 1 2010-11-01 15:59:57 PDT

Created attachment 72580 [details] Patch

Tony Chang

Comment 2 2010-11-01 16:20:35 PDT

Comment on attachment 72580 [details] Patch Can you make a layout test for this?

Daniel Cheng

Comment 3 2010-11-01 17:26:58 PDT

Comment on attachment 72580 [details] Patch R- while I work on layout test.

Daniel Cheng

Comment 4 2010-11-05 16:17:37 PDT

This one seems to require an empty top-level document to repro. Given the current testing infrastructure, I do not think it is possible to write a layout test. I can attach a manual test to the bug if you want.

Tony Chang

Comment 5 2010-11-08 13:34:28 PST

Sure, let's just go for a manual test.

Daniel Cheng

Comment 6 2010-11-08 16:23:19 PST

Created attachment 73304 [details] Patch

Tony Chang

Comment 7 2010-11-08 16:33:09 PST

Comment on attachment 73304 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=73304&action=review > WebCore/ChangeLog:13 > + * manual-tests/drop-in-empty-doc2.xhtml: Added. drop-in-empty-doc2.xhtml should go in manual-tests/resources/. > WebCore/page/DragController.cpp:271 > +// This can return null if an empty document is loaded. Is this new or have we had this bug for a long time? It seems odd that this is suddenly not working. Do you know which change regressed this? I'm worried we're papering over the crash when the fix is elsewhere.

Daniel Cheng

Comment 8 2010-11-08 18:09:29 PST

(In reply to comment #7) > (From update of attachment 73304 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=73304&action=review > > > WebCore/ChangeLog:13 > > + * manual-tests/drop-in-empty-doc2.xhtml: Added. > > drop-in-empty-doc2.xhtml should go in manual-tests/resources/. > > > WebCore/page/DragController.cpp:271 > > +// This can return null if an empty document is loaded. > > Is this new or have we had this bug for a long time? It seems odd that this is suddenly not working. Do you know which change regressed this? > > I'm worried we're papering over the crash when the fix is elsewhere. I think we've had this bug for a long time (it crashes Chrome 7 as well).

Ryosuke Niwa

Comment 9 2010-12-03 01:08:33 PST

Crash is P1.

Tony Chang

Comment 10 2010-12-03 09:53:04 PST

Comment on attachment 73304 [details] Patch Sorry, I forgot about this. I'm going to do some testing in Safari before landing, so removing cq flag.

Tony Chang

Comment 11 2010-12-03 11:18:27 PST

Committed r73276: <http://trac.webkit.org/changeset/73276>

Tony Chang

Comment 12 2010-12-03 11:25:46 PST

(In reply to comment #11) > Committed r73276: <http://trac.webkit.org/changeset/73276> I verified that this crashes on both Safari 5.0.x (mac) and Safari with WebKit ToT. The patch fixes it. I also moved the .xhtml test file into the resources subdir.

Note You need to log in before you can comment on or make changes to this bug.