RESOLVED WORKSFORME 74924
editing: NULL ptr in line-break handling when text node is removed from document 
https://bugs.webkit.org/show_bug.cgi?id=74924
Summary editing: NULL ptr in line-break handling when text node is removed from document
Berend-Jan Wever
Reported 2011-12-20 05:24:00 PST
Created attachment 120012 [details] Repro Chromium: http://code.google.com/p/chromium/issues/detail?id=108163 <style> /* These values are needed to cause line breaks, but are otherwise not involved in the crash AFAIK */ * { padding-left: 100px; } body { width: 100px; } </style><script> window.onload = function () { document.execCommand('SelectAll'); var oA1 = document.getElementById("1"); oA1.removeChild(oA1.firstChild); var oSelection = window.getSelection(); oSelection.modify("move","backward","paragraph"); }; </script> <body contenteditable="true"> <a id="1"> Some text is needed here <a id="2">There can be no white-space before this text </a> </a> </body> Not sure what is going on here - I'm not familiar with the "leafChild" code and how line-breaks are handled. However, it is a clean NULL ptr because the "firstLeafChild" of the document is NULL and gets used regardless. id: webkit.dll!WebCore::InlineBox::isHorizontal ReadAV@NULL (5446f106152a0ccff998d095bc4ad267) description: Attempt to read from unallocated NULL pointer+0x21 in webkit.dll!WebCore::InlineBox::isHorizontal application: Chrome 18.0.976.0 stack: webkit.dll!WebCore::InlineBox::isHorizontal webkit.dll!WebCore::InlineBox::logicalLeft webkit.dll!WebCore::RootInlineBox::closestLeafChildForLogicalLeftPosition webkit.dll!WebCore::RootInlineBox::closestLeafChildForPoint webkit.dll!WebCore::previousLinePosition webkit.dll!WebCore::previousParagraphPosition webkit.dll!WebCore::FrameSelection::modifyMovingBackward webkit.dll!WebCore::FrameSelection::modify webkit.dll!WebCore::DOMSelection::modify webkit.dll!WebCore::DOMSelectionInternal::modifyCallback ... Not affected: 16.0.877.0- Affected: 16.0.912.63+
Attachments
Repro (605 bytes, text/html)
2011-12-20 05:24 PST, Berend-Jan Wever 		no flags
Details
View All Add attachment proposed patch, testcase, etc.
Ryosuke Niwa
Comment 1 2012-04-30 15:32:48 PDT
No longer reproduces.
Note You need to log in before you can comment on or make changes to this bug.