Bug 67762 – Crashes in WebCore::ReplaceSelectionCommand::doApply

• Status: RESOLVED
• Resolution: FIXED
• Component: HTML Editing

[Shinya Kawanaka]

https://bugs.webkit.org/show_bug.cgi?id=67668

testcase1::
<feSpotLight><sub id="div" contenteditable="true"><script>
var sel = window.getSelection();

sel.setPosition(div, 0);
document.execCommand("InsertHTML", false, "<dl>");
</script>

[Shinya Kawanaka]

Created attachment 106700 [details]
Patch

[Kent Tamura]

Comment on attachment 106700 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=106700&action=review

> LayoutTests/ChangeLog:11
> +        * editing/inserting/insert-replaceselection-crash-expected.txt: Added.
> +        * editing/inserting/insert-replaceselection-crash.html: Added.

It's better, but we had better describe a test case, rather than a crash location.
How about insert-without-enclosing-block.html?

> Source/WebCore/ChangeLog:10
> +        Test: editing/inserting/insert-67668-crash.html

Need to update.

[Ryosuke Niwa]

Comment on attachment 106700 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=106700&action=review

> LayoutTests/editing/inserting/insert-replaceselection-crash.html:7
> +var sel = window.getSelection();
> +
> +sel.setPosition(div, 0);

It seems redundant to declare sel.

[Shinya Kawanaka]

Created attachment 106703 [details]
Patch

[Shinya Kawanaka]

Reflected the above comments.

[Ryosuke Niwa]

Comment on attachment 106703 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=106703&action=review

> LayoutTests/ChangeLog:11
> +        * editing/inserting/insert-replaceselection-crash-expected.txt: Added.
> +        * editing/inserting/insert-replaceselection-crash.html: Added.

You should rename the test as tkent suggested.

[Shinya Kawanaka]

(In reply to comment #6)
> (From update of attachment 106703 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=106703&action=review
> 
> > LayoutTests/ChangeLog:11
> > +        * editing/inserting/insert-replaceselection-crash-expected.txt: Added.
> > +        * editing/inserting/insert-replaceselection-crash.html: Added.
> 
> You should rename the test as tkent suggested.

Oops, sorry. I'll fix them soon.

[Shinya Kawanaka]

Created attachment 106706 [details]
Patch

[WebKit Review Bot]

Comment on attachment 106706 [details]
Patch

Clearing flags on attachment: 106706

Committed r94793: <http://trac.webkit.org/changeset/94793>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.