Bug 26076 - Custom highlighting (via -webkit-highlight) can crash
Summary: Custom highlighting (via -webkit-highlight) can crash
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKit API (show other bugs)
Version: 528+ (Nightly build)
Hardware: Mac OS X 10.5
: P2 Major
Assignee: Nobody
Keywords: Regression
Depends on:
Reported: 2009-05-29 03:08 PDT by Kai Brüning
Modified: 2017-06-16 22:32 PDT (History)
1 user (show)

See Also:

Test case - crashes on loading (475 bytes, application/xhtml+xml)
2009-05-29 03:09 PDT, Kai Brüning
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Kai Brüning 2009-05-29 03:08:34 PDT
The functions WebChromeClient::customHighlightRect() and WebChromeClient::paintCustomHighlight() get passed a node. With Changeset 40871 (committed 2009-02-11), the passed node can be 0, which results in a crash.

I include a test case which crashes when opening.
Comment 1 Kai Brüning 2009-05-29 03:09:28 PDT
Created attachment 30771 [details]
Test case - crashes on loading
Comment 2 Kai Brüning 2009-05-29 03:16:37 PDT
I forgot to mention that the problem is triggered by having generated content in the document (via h1:empty:before {content:"some text";} in this case).

I do not know whether this is the only way to trigger the problem, though.
Comment 3 mitz 2017-06-16 22:32:22 PDT
paintCustomHighlight and the SPI that relied on it have been removed via bug 128456.