Bug 48104 - Crash in insertText command
Summary: Crash in insertText command
Status: RESOLVED LATER
Alias: None
Product: WebKit
Classification: Unclassified
Component: HTML Editing (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P1 Normal
Assignee: Nobody
URL:
Keywords: HasReduction
Depends on:
Blocks:
 
Reported: 2010-10-21 17:13 PDT by Ryosuke Niwa
Modified: 2012-05-25 00:09 PDT (History)
4 users (show)

See Also:

Attachments
demo (364 bytes, text/html)
2010-10-21 17:13 PDT, Ryosuke Niwa 		no flags Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Ryosuke Niwa 2010-10-21 17:13:36 PDT 
Created attachment 71511 [details]
demo

Crash occurs when removing format from:
<div style="display: table; position: absolute;">
<div contenteditable style="display: table-cell;"><br>hello<br></div>
</div>

#0	0x10159164a in WebCore::CompositeEditCommand::insertNodeAt at CompositeEditCommand.cpp:161
#1	0x1019faeb4 in WebCore::InsertTextCommand::prepareForTextInsertion at InsertTextCommand.cpp:63
#2	0x1019fb42e in WebCore::InsertTextCommand::input at InsertTextCommand.cpp:167
#3	0x101592149 in WebCore::CompositeEditCommand::inputText at CompositeEditCommand.cpp:313
#4	0x101e26735 in WebCore::RemoveFormatCommand::doApply at RemoveFormatCommand.cpp:83

http://crbug.com/53392
Comment 1 Ryosuke Niwa 2010-10-22 11:38:17 PDT 
This seems to be a bug in TextIterator.  When we apply typing style back at the end of InsertLineBreakCommand, which is called by inputText, we end up moving the selection to the outer non-editable div.  So when inputText calls InsertTextCommand::input, the selection is outside of the editable region and results in an assertion failure.
Comment 2 Ryosuke Niwa 2010-10-25 17:20:17 PDT 
This bug is no longer reproducible on TOT WebKit because of http://trac.webkit.org/changeset/70283.  I keep this bug open because the bug that caused this crash still exists in TextIterator.
Comment 3 Alexey Proskuryakov 2011-01-20 16:16:12 PST 
Would it make sense to file a new bug for the remaining issue?
Comment 4 Ryosuke Niwa 2012-05-25 00:09:11 PDT 
At this point, I don't even remember what this bug was.