Bug 9879 – REGRESSION: Repro crash when clicking to the side of an anonymous table

• Component: Layout and Rendering
• Status: RESOLVED FIXED

Clicking to the right of the text in the test case causes TOT to crash with the following backtrace:

#0  0x01aa9cac in WebCore::maxDeepOffset (node=0x0) at WebCore/editing/htmlediting.cpp:321
#1  0x01a18618 in WebCore::RenderContainer::positionForCoordinates (this=0x196d682c, x=89, y=73) at WebCore/rendering/RenderContainer.cpp:511
#2  0x019f9cfc in WebCore::RenderBlock::positionForCoordinates (this=0x196d682c, x=89, y=73) at WebCore/rendering/RenderBlock.cpp:2607
#3  0x019fa7d8 in WebCore::RenderBlock::positionForCoordinates (this=0x196d65cc, x=89, y=73) at WebCore/rendering/RenderBlock.cpp:2700
#4  0x01ce78f4 in WebCore::RenderObject::positionForPoint (this=0x196d65cc, point=@0xbfffe2dc) at WebCore/page/ResourceRequest.h:531
#5  0x01922d34 in WebCore::Frame::handleMousePressEventSingleClick (this=0x14a5b990, event=@0xbfffe7f0) at WebCore/page/Frame.cpp:1823
#6  0x01923700 in WebCore::Frame::handleMousePressEvent (this=0x14a5b990, event=@0xbfffe7f0) at WebCore/page/Frame.cpp:1874
#7  0x01935ed0 in WebCore::FrameMac::handleMousePressEvent (this=0x14a5b990, event=@0xbfffe7f0) at WebCore/bridge/mac/FrameMac.mm:1423
#8  0x0194946c in WebCore::FrameView::handleMousePressEvent (this=0x1960f440, mouseEvent=@0xbfffebc0) at WebCore/page/FrameView.cpp:584
#9  0x01935b74 in WebCore::FrameMac::mouseDown (this=0x14a5b990, event=0x19614090) at WebCore/bridge/mac/FrameMac.mm:1983
#10 0x01967e88 in -[WebCoreFrameBridge mouseDown:] (self=0x14a61c70, _cmd=0x90aa0330, event=0x19614090) at WebCore/bridge/mac/WebCoreFrameBridge.mm:1030
#11 0x00372e8c in -[WebHTMLView mouseDown:] (self=0x179feab0, _cmd=0x90aa0330, event=0x19614090) at WebKit/WebView/WebHTMLView.m:2858
#12 0x9374a890 in -[NSWindow sendEvent:] ()
#13 0x00021734 in ?? ()
#14 0x936f38d4 in -[NSApplication sendEvent:] ()
#15 0x00021238 in ?? ()
#16 0x936ead10 in -[NSApplication run] ()
#17 0x937db87c in NSApplicationMain ()
#18 0x0005c77c in ?? ()
#19 0x0005c624 in ?? ()

Created attachment 9408 [details]
Test case (will crash)

Created attachment 9412 [details]
One-liner patch with layout test and change log entry

[Darin Adler]

Comment on attachment 9412 [details]
One-liner patch with layout test and change log entry

r=me

[David Kilzer (:ddkilzer)]

This one is waiting for a Radar bug to be created before it can be committed.

[Darin Adler]

<rdar://problem/4628129> REGRESSION: Repro crash when clicking to the side of an anonymous table

[David Kilzer (:ddkilzer)]

This patch (attachment 9412 [details]) has bit-rotted after Justin committed r15401:

<rdar://problem/4509393> selected DOM range starts with <object>, 0 offset but selection should include the <object>

This changed the infamous one-line to this:

-    if (isTable()) {
+    if (isTable() && element()) {

I reran the included test, and it passed.  I suggest landing just the layout tests for this one.  Thoughts?

[David Kilzer (:ddkilzer)]

Comment on attachment 9412 [details]
One-liner patch with layout test and change log entry

Clearing review flag due to bit rottedness.  See Comment #6.

(In reply to comment #6)
> I suggest landing just the layout
> tests for this one.  Thoughts?

Seems reasonable.

[David Kilzer (:ddkilzer)]

Committed revision 15425.

Note that only the layout test part of this patch (attachment 9412 [details]) was committed.  (I probably shouldn't have cleared Darin's r=me.)  See Comment # 6 for details.