https://bugs.webkit.org/show_bug.cgi?id=67668 testcase1:: <feSpotLight><sub id="div" contenteditable="true"><script> var sel = window.getSelection(); sel.setPosition(div, 0); document.execCommand("InsertHTML", false, "<dl>"); </script>
Created attachment 106700 [details] Patch
Comment on attachment 106700 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=106700&action=review > LayoutTests/ChangeLog:11 > + * editing/inserting/insert-replaceselection-crash-expected.txt: Added. > + * editing/inserting/insert-replaceselection-crash.html: Added. It's better, but we had better describe a test case, rather than a crash location. How about insert-without-enclosing-block.html? > Source/WebCore/ChangeLog:10 > + Test: editing/inserting/insert-67668-crash.html Need to update.
Comment on attachment 106700 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=106700&action=review > LayoutTests/editing/inserting/insert-replaceselection-crash.html:7 > +var sel = window.getSelection(); > + > +sel.setPosition(div, 0); It seems redundant to declare sel.
Created attachment 106703 [details] Patch
Reflected the above comments.
Comment on attachment 106703 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=106703&action=review > LayoutTests/ChangeLog:11 > + * editing/inserting/insert-replaceselection-crash-expected.txt: Added. > + * editing/inserting/insert-replaceselection-crash.html: Added. You should rename the test as tkent suggested.
(In reply to comment #6) > (From update of attachment 106703 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=106703&action=review > > > LayoutTests/ChangeLog:11 > > + * editing/inserting/insert-replaceselection-crash-expected.txt: Added. > > + * editing/inserting/insert-replaceselection-crash.html: Added. > > You should rename the test as tkent suggested. Oops, sorry. I'll fix them soon.
Created attachment 106706 [details] Patch
Comment on attachment 106706 [details] Patch Clearing flags on attachment: 106706 Committed r94793: <http://trac.webkit.org/changeset/94793>
All reviewed patches have been landed. Closing bug.