Bug 84937

Summary: FormatBlock crashes when body element is removed prior to the command execution
Product: WebKit Reporter: Ryosuke Niwa <rniwa>
Component: HTML EditingAssignee: Ryosuke Niwa <rniwa>
Status: RESOLVED FIXED    
Severity: Normal CC: adele, darin, enrica, webkit.review.bot
Priority: P1    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Fixes the crash none

Ryosuke Niwa
Reported 2012-04-26 02:52:28 PDT
Reduction: <!DOCTYPE html> <body> </body> <script type="text/javascript"> document.designMode = 'on'; document.execCommand("SelectAll"); document.documentElement.removeChild(document.body); document.execCommand("FormatBlock", false, "div"); </script> http://code.google.com/p/chromium/issues/detail?id=123441
Attachments
Fixes the crash (4.56 KB, patch)
2012-04-26 03:01 PDT, Ryosuke Niwa 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Ryosuke Niwa
Comment 1 2012-04-26 03:01:50 PDT
Created attachment 138961 [details] Fixes the crash
WebKit Review Bot
Comment 2 2012-04-27 11:52:29 PDT
Comment on attachment 138961 [details] Fixes the crash Clearing flags on attachment: 138961 Committed r115461: <http://trac.webkit.org/changeset/115461>
WebKit Review Bot
Comment 3 2012-04-27 11:52:33 PDT
All reviewed patches have been landed. Closing bug.
Note You need to log in before you can comment on or make changes to this bug.