We're getting reports of a crash in WebCore::createMarkup(). This is due to code introduced in http://trac.webkit.org/changeset/144995 Index: Source/WebCore/editing/markup.cpp =================================================================== --- Source/WebCore/editing/markup.cpp (revision 144994) +++ Source/WebCore/editing/markup.cpp (revision 144995) ... @@ -522,7 +523,7 @@ Node* checkAncestor = specialCommonAncestor ? specialCommonAncestor : commonAncestor; if (checkAncestor->renderer()) { - Node* newSpecialCommonAncestor = highestEnclosingNodeOfType(firstPositionInNode(checkAncestor), &isElementPresentational); + Node* newSpecialCommonAncestor = highestEnclosingNodeOfType(firstPositionInNode(checkAncestor), &isElementPresentational, CanCrossEditingBoundary, checkAncestor->renderer()->containingBlock()->node()); if (newSpecialCommonAncestor) specialCommonAncestor = newSpecialCommonAncestor; } The containingBlock() call in the last argument of the new method signature can potentially be null and thus calling node() on it may result in a crash.
<rdar://problem/14480588>
Created attachment 206985 [details] Patch
Created attachment 206986 [details] Patch
Comment on attachment 206986 [details] Patch Attachment 206986 [details] did not pass mac-ews (mac): Output: http://webkit-queues.appspot.com/results/1106584 New failing tests: media/video-zoom.html
Created attachment 206991 [details] Archive of layout-test-results from webkit-ews-01 for mac-mountainlion The attached test failures were seen while running run-webkit-tests on the mac-ews. Bot: webkit-ews-01 Port: mac-mountainlion Platform: Mac OS X 10.8.3
I don't think the crash failure in this media test is related to this patch.
Can we add a new test case for this?
Comment on attachment 206986 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=206986&action=review I can't come up with a test case for this. > Source/WebCore/ChangeLog:9 > + Reviewed by NOBODY (OOPS!). This line should appear before the long description but after the bug URL.
(In reply to comment #8) > (From update of attachment 206986 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=206986&action=review > > I can't come up with a test case for this. Yeah, me neither (should have put that upfront in the comments). > > Source/WebCore/ChangeLog:9 > > + Reviewed by NOBODY (OOPS!). > > This line should appear before the long description but after the bug URL. Will clean up as I land.
http://trac.webkit.org/changeset/152858