Bug 77213

Summary: NULL ptr in WebCore::RemoveCSSPropertyCommand::doApply
Product: WebKit Reporter: Berend-Jan Wever <skylined>
Component: HTML EditingAssignee: Nobody <webkit-unassigned>
Status: RESOLVED LATER    
Severity: Normal CC: rniwa
Priority: P1    
Version: 528+ (Nightly build)   
Hardware: PC   
OS: Windows Vista   
Attachments:
Description Flags
Patch
allan.jensen: review-
reduction none

Berend-Jan Wever
Reported 2012-01-27 07:00:40 PST
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=15995603 Uploader: skylined@chromium.org Crash Type: UNKNOWN Crash Address: 0x000000000000 Crash State: - crash stack - WebCore::RemoveCSSPropertyCommand::doApply WebCore::EditCommandComposition::reapply WebKit::EditorClientImpl::redo Regressed: https://cluster-fuzz.appspot.com/revisions?range=115632:115640 Minimized Testcase (0.61 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95KgegmB-Vv_O2KUmhDyR7V_SxmKF5mX4dShselJcdKyLW4_3NYJK5xhvwIA4F8zPLo3TgrCEm6Kwa5t1kGAe9OcHnT0ssM0vL5MUi8BBpBg9HVNHJjNtgxRZ_PMWhIrJYRajGYWO9fZYD_EqDl2scLGhFc4w
Attachments
Patch (4.38 KB, text/plain)
2012-01-27 07:39 PST, Allan Sandfeld Jensen 		allan.jensen: review-
Details
reduction (629 bytes, text/html)
2012-04-30 15:01 PDT, Ryosuke Niwa 		no flags
Details
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
Berend-Jan Wever
Comment 1 2012-01-27 07:04:02 PST
Chromium: http://code.google.com/p/chromium/issues/detail?id=111626
Allan Sandfeld Jensen
Comment 2 2012-01-27 07:39:37 PST
Created attachment 124315 [details] Patch
Kenneth Rohde Christiansen
Comment 3 2012-01-27 07:41:06 PST
(In reply to comment #2) > Created an attachment (id=124315) [details] > Patch Not the right bug I suppose!
Allan Sandfeld Jensen
Comment 4 2012-01-27 07:41:45 PST
Comment on attachment 124315 [details] Patch Submitted to wrong bug
Ryosuke Niwa
Comment 5 2012-04-30 15:01:15 PDT
Created attachment 139526 [details] reduction I can no longer reproduce this crash. WebKit just hangs.
Ryosuke Niwa
Comment 6 2012-04-30 15:02:42 PDT
Since the hang/crash is caused by mutual recursions instructed by the script, I don't think there is a way to fix this bug. Please re-open the bug if you can still reproduce this crash on some port/platform.
Note You need to log in before you can comment on or make changes to this bug.