Created attachment 45326 [details] Repro Id: WebCore::ApplyStyleCommand::removeInlineStyle ReadAV@NULL (18fa82a60d48c7965db66b916a546328) Description: Attempt to read from NULL pointer in WebCore::ApplyStyleCommand::removeInlineStyle Stack: WebCore::ApplyStyleCommand::removeInlineStyle WebCore::ApplyStyleCommand::applyInlineStyle WebCore::ApplyStyleCommand::doApply WebCore::EditCommand::apply WebCore::applyCommand WebCore::Editor::applyStyle WebCore::executeApplyStyle WebCore::executeForeColor WebCore::Editor::Command::execute WebCore::Document::execCommand WebCore::DocumentInternal::execCommandCallback Repro: <BODY></BODY> <SCRIPT> document.designMode="on"; document.execCommand("selectall"); document.execCommand("InsertHorizontalRule"); document.execCommand("SelectAll"); document.execCommand("ForwardDelete"); document.designMode="off"; document.execCommand("undo"); document.designMode="on"; document.execCommand("ForeColor",false,3); </SCRIPT>
Online repro
This bug is a dup of 32823; it's the "undo" in designMode off that causes the problem.
*** This bug has been marked as a duplicate of bug 32823 ***