Bug 36800 - Ownerless nodes leads a crash on DOMSelection APIs
Summary: Ownerless nodes leads a crash on DOMSelection APIs
Alias: None
Product: WebKit
Classification: Unclassified
Component: HTML Editing (show other bugs)
Version: 528+ (Nightly build)
Hardware: PC OS X 10.5
: P2 Normal
Assignee: Nobody
Depends on:
Reported: 2010-03-29 19:25 PDT by Hajime Morrita
Modified: 2010-04-01 22:33 PDT (History)
0 users

See Also:

to reproduce (326 bytes, text/html)
2010-03-30 02:40 PDT, Hajime Morrita
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Hajime Morrita 2010-03-29 19:25:24 PDT
Passing ownerless node to DOMSelection APIs including collapse(), extend(), selectAllChildren(), setPosition() causes a crash.
One type of ownerless node is newly-created DocumentType object.
This is similar to Bug 31680 and the fix on Bug 31680 will fix these. But we need regressions for that.
Comment 1 Hajime Morrita 2010-03-30 02:40:28 PDT
Created attachment 52015 [details]
to reproduce
Comment 2 Hajime Morrita 2010-04-01 22:33:17 PDT
Fixed at http://trac.webkit.org/changeset/56962