Bug 28474 - REGESSION(r45316), Crash: WebKit crashes in Google Sites when indenting a table
Summary: REGESSION(r45316), Crash: WebKit crashes in Google Sites when indenting a table
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: HTML Editing (show other bugs)
Version: 528+ (Nightly build)
Hardware: PC All
: P1 Critical
Assignee: Ryosuke Niwa
URL:
Keywords: Regression
Depends on:
Blocks:
 
Reported: 2009-08-19 17:00 PDT by Ryosuke Niwa
Modified: 2009-08-20 22:29 PDT (History)
2 users (show)

See Also:


Attachments
demo, crashes your WebKit (433 bytes, text/html)
2009-08-19 20:13 PDT, Ryosuke Niwa
no flags Details
fixes the bug, one line change. (3.87 KB, patch)
2009-08-19 20:23 PDT, Ryosuke Niwa
darin: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Ryosuke Niwa 2009-08-19 17:00:38 PDT
What steps will reproduce the problem?
1. Create a table in a Google Sites page. For example, 2x2. I think any size will do.
2. Click next to the right of the table, outside of it.
3. Click in the 'indent right' button.

What is the expected result?
The table is indented to the right.

Chromium bug report: http://code.google.com/p/chromium/issues/detail?id=18284

This could be a regression due to http://trac.webkit.org/changeset/45316.
Comment 1 Ryosuke Niwa 2009-08-19 20:13:20 PDT
Created attachment 35179 [details]
demo, crashes your WebKit
Comment 2 Ryosuke Niwa 2009-08-19 20:23:44 PDT
Created attachment 35182 [details]
fixes the bug, one line change.
Comment 3 Darin Adler 2009-08-19 21:59:30 PDT
Comment on attachment 35182 [details]
fixes the bug, one line change.

Can endOfCurrentParagraph ever have 0 for a node?

r=me assuming the answer is no
Comment 4 Ryosuke Niwa 2009-08-19 22:37:42 PDT
(In reply to comment #3)
> (From update of attachment 35182 [details])
> Can endOfCurrentParagraph ever have 0 for a node?
> 
> r=me assuming the answer is no

It should never be.  We could add an ASSERT there but the ending condition of the while loop is that we traverse through nodes until we reach end of selection.  So should it ever be null, we fall into an infinite loop.

http://trac.webkit.org/browser/trunk/WebCore/editing/IndentOutdentCommand.cpp#L207
Comment 5 Ryosuke Niwa 2009-08-20 22:29:34 PDT
Landed in http://trac.webkit.org/changeset/47608.