Bug 77218 - NULL ptr in WebCore::Range::getBorderAndTextQuads
Summary: NULL ptr in WebCore::Range::getBorderAndTextQuads
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: DOM (show other bugs)
Version: 528+ (Nightly build)
Hardware: PC Windows Vista
: P1 Normal
Assignee: Ryosuke Niwa
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-01-27 07:18 PST by Berend-Jan Wever
Modified: 2012-04-30 15:51 PDT (History)
7 users (show)

See Also:


Attachments
Fixes the crash (4.17 KB, patch)
2012-04-30 14:33 PDT, Ryosuke Niwa
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Berend-Jan Wever 2012-01-27 07:18:11 PST
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=15992978

Uploader: skylined@chromium.org

Crash Type: UNKNOWN
Crash Address: 0x000000000024
Crash State:
  - crash stack -
  WebCore::Range::getBorderAndTextQuads
  WebCore::Range::boundingRect
  WebCore::Range::getBoundingClientRect
  
Regressed: https://cluster-fuzz.appspot.com/revisions?range=108839:108881

Minimized Testcase (1.41 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94sYtyY7GIxx6IaywhcjimvW1hTKDKblRUvsoU_E-sx8mxItU3CF_jlHEjEXOcSHtmTFe8pDGTsyjWWbllly3tEyYJmA9eIInB-90Z3cIcfU8oY935-hLScNr7EbUCRsFBWHrp6QmbtpR9NJgNeo1SvnfJnXw
Comment 1 Ryosuke Niwa 2012-04-30 14:01:39 PDT
Simplified reduction:

<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml">
<style></style>
<script>
<![CDATA[

window.onload = function () {
    document.execCommand("SelectAll", false);

    var range = null;

    document.addEventListener("DOMNodeRemovedFromDocument", function () {
        range = getSelection().getRangeAt(0);
    },true);

    getSelection().getRangeAt(0).extractContents();
    range.getBoundingClientRect();
}

]]>
</script>
<input/>
</html>
Comment 2 Ryosuke Niwa 2012-04-30 14:33:21 PDT
Created attachment 139520 [details]
Fixes the crash
Comment 3 Eric Seidel (no email) 2012-04-30 15:11:37 PDT
Comment on attachment 139520 [details]
Fixes the crash

Seems totally reasonable.
Comment 4 WebKit Review Bot 2012-04-30 15:51:00 PDT
Comment on attachment 139520 [details]
Fixes the crash

Clearing flags on attachment: 139520

Committed r115686: <http://trac.webkit.org/changeset/115686>
Comment 5 WebKit Review Bot 2012-04-30 15:51:05 PDT
All reviewed patches have been landed.  Closing bug.