Bug 139303 - Crash in WebCore::Node::getFlag
Summary: Crash in WebCore::Node::getFlag
Status: RESOLVED WORKSFORME
Alias: None
Product: WebKit
Classification: Unclassified
Component: HTML Editing (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks: 116980
  Show dependency tree / graph
 
Reported: 2014-12-05 09:34 PST by Renata Hodovan
Modified: 2016-08-04 10:44 PDT (History)
3 users (show)

See Also:

Attachments
Test case (285 bytes, text/html)
2014-12-05 09:34 PST, Renata Hodovan 		no flags Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Renata Hodovan 2014-12-05 09:34:41 PST 
Created attachment 242636 [details]
Test case

Load this test:

<li></li>
<li>aaaa</li>
<script>
</script>
<style>
*  {
    -webkit-transition-delay:630s;
    line-height:.0;
}
</style>
<script>
    document.designMode = 'on';
    document.execCommand("selectAll", false, null);
    document.execCommand("insertOrderedList" , true , null);
</script>


Backtrace:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fff98927700 (LWP 19580)]
0x00007ffff27a12ed in WebCore::Node::getFlag (this=0x0, mask=WebCore::Node::IsElementFlag) at ../../Source/WebCore/dom/Node.h:628
628	    bool getFlag(NodeFlags mask) const { return m_nodeFlags & mask; }
#0  0x00007ffff27a12ed in WebCore::Node::getFlag (this=0x0, mask=WebCore::Node::IsElementFlag) at ../../Source/WebCore/dom/Node.h:628
#1  0x00007ffff27c0ae9 in WebCore::Node::isElementNode (this=0x0) at ../../Source/WebCore/dom/Node.h:226
#2  0x00007ffff324cb3f in WebCore::isBlockFlowElement (node=0x0) at ../../Source/WebCore/editing/htmlediting.cpp:1242
#3  0x00007ffff31f5e05 in WebCore::InsertListCommand::doApplyForSingleParagraph (this=0x62e770, forceCreateList=true, listTag=..., currentSelection=0x62e950) at ../../Source/WebCore/editing/InsertListCommand.cpp:228
#4  0x00007ffff31f5239 in WebCore::InsertListCommand::doApply (this=0x62e770) at ../../Source/WebCore/editing/InsertListCommand.cpp:163
#5  0x00007ffff3197f25 in WebCore::CompositeEditCommand::apply (this=0x62e770) at ../../Source/WebCore/editing/CompositeEditCommand.cpp:207
#6  0x00007ffff3197cdc in WebCore::applyCommand (command=...) at ../../Source/WebCore/editing/CompositeEditCommand.cpp:167
#7  0x00007ffff31dacbf in WebCore::executeInsertOrderedList (frame=...) at ../../Source/WebCore/editing/EditorCommand.cpp:549
#8  0x00007ffff31de3f9 in WebCore::Editor::Command::execute (this=0x7fffffffbed0, parameter=..., triggeringEvent=0x0) at ../../Source/WebCore/editing/EditorCommand.cpp:1726
#9  0x00007ffff306fbbc in WebCore::Document::execCommand (this=0x475600, commandName=..., userInterface=true, value=...) at ../../Source/WebCore/dom/Document.cpp:4375
#10 0x00007ffff408c28a in WebCore::jsDocumentPrototypeFunctionExecCommand (exec=0x7fffffffbfd0) at DerivedSources/WebCore/JSDocument.cpp:4526
#11 0x00007fff9a5fc0b4 in ?? ()
#12 0x00007fffffffc030 in ?? ()
#13 0x00007fffedb73e7d in llint_entry () from /home/reni/data/REPOS/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18
Comment 1 Brent Fulgham 2016-08-04 10:44:20 PDT 
This issue no longer happens in r204037 under GuardMalloc or ASAN. If you believe there is still an issue, please reopen this bug with a revised test case.