Bug 84937

Summary:

FormatBlock crashes when body element is removed prior to the command execution

Product:

WebKit

Reporter:

Ryosuke Niwa <rniwa>

Component:

HTML Editing

Assignee:

Ryosuke Niwa <rniwa>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

adele, darin, enrica, webkit.review.bot

Priority:

Version:

528+ (Nightly build)

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
Fixes the crash	none

Description Ryosuke Niwa 2012-04-26 02:52:28 PDT

Reduction:

<!DOCTYPE html>
<body>
</body>
<script type="text/javascript">
document.designMode = 'on';
document.execCommand("SelectAll");
document.documentElement.removeChild(document.body);
document.execCommand("FormatBlock", false, "div");
</script>

http://code.google.com/p/chromium/issues/detail?id=123441

Comment 1 Ryosuke Niwa 2012-04-26 03:01:50 PDT

Created attachment 138961 [details]
Fixes the crash

Comment 2 WebKit Review Bot 2012-04-27 11:52:29 PDT

Comment on attachment 138961 [details]
Fixes the crash

Clearing flags on attachment: 138961

Committed r115461: <http://trac.webkit.org/changeset/115461>

Comment 3 WebKit Review Bot 2012-04-27 11:52:33 PDT

All reviewed patches have been landed.  Closing bug.