Bug 31023 - Safari crashes when calling execCommand on formatted html in special case
Summary: Safari crashes when calling execCommand on formatted html in special case
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: HTML Editing (show other bugs)
Version: 528+ (Nightly build)
Hardware: PC All
: P2 Normal
Assignee: Enrica Casucci
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2009-11-02 11:52 PST by Enrica Casucci
Modified: 2009-11-02 17:07 PST (History)
0 users

See Also:


Attachments
Patch (4.20 KB, patch)
2009-11-02 11:58 PST, Enrica Casucci
adele: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Enrica Casucci 2009-11-02 11:52:07 PST
Imagine to use your WebMail allowing to compose a message in HTML format. You obtain a new message and wants to reply, so:

1. have specially crafted HTML text, e.g.:

<span>
Line 1.
<br>
<b>Select all text in this line and use justify command. Actual result: Safari crashes.</b>
<br>
Line 3.
</span>

2. select all text in the 2nd line

3. try to center the line: document.execCommand('JustifyCenter', false, null) is called

Actual result: unexpected crash
Comment 1 Enrica Casucci 2009-11-02 11:58:23 PST
Created attachment 42332 [details]
Patch
Comment 2 Adele Peterson 2009-11-02 12:01:16 PST
Comment on attachment 42332 [details]
Patch

You should add a newline at the end of your test to prevent that warning.  r=me!
Comment 3 mitz 2009-11-02 12:01:54 PST
Comment on attachment 42332 [details]
Patch

> +    RenderObject* cb = containingBlock();
> +    if (cb)
> +        cb->setSelectionState(state);

We usually combine such cases into
if (RenderObject* cb = containingBlock())
    cb->setSelectionState(state);

I think you can also use a RenderBlock* because that’s the return type of containingBlock().

> +</html>
> \ No newline at end of file

Please add a newline.
Comment 4 Enrica Casucci 2009-11-02 17:07:50 PST
Committed revision 50433.