Bug 84937 - FormatBlock crashes when body element is removed prior to the command execution
Summary: FormatBlock crashes when body element is removed prior to the command execution
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: HTML Editing (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P1 Normal
Assignee: Ryosuke Niwa
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-04-26 02:52 PDT by Ryosuke Niwa
Modified: 2012-04-27 11:52 PDT (History)
4 users (show)

See Also:


Attachments
Fixes the crash (4.56 KB, patch)
2012-04-26 03:01 PDT, Ryosuke Niwa
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Ryosuke Niwa 2012-04-26 02:52:28 PDT
Reduction:

<!DOCTYPE html>
<body>
</body>
<script type="text/javascript">
document.designMode = 'on';
document.execCommand("SelectAll");
document.documentElement.removeChild(document.body);
document.execCommand("FormatBlock", false, "div");
</script>

http://code.google.com/p/chromium/issues/detail?id=123441
Comment 1 Ryosuke Niwa 2012-04-26 03:01:50 PDT
Created attachment 138961 [details]
Fixes the crash
Comment 2 WebKit Review Bot 2012-04-27 11:52:29 PDT
Comment on attachment 138961 [details]
Fixes the crash

Clearing flags on attachment: 138961

Committed r115461: <http://trac.webkit.org/changeset/115461>
Comment 3 WebKit Review Bot 2012-04-27 11:52:33 PDT
All reviewed patches have been landed.  Closing bug.