[Webkit-unassigned] [Bug 10127] REGRESSION: Crash undoing delete in textarea

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=10127


ddkilzer at webkit.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                URL|                            |data:text/html,<textarea>




------- Comment #7 from ddkilzer at webkit.org  2007-01-26 15:52 PDT -------
Steps to reproduce!

1. Open Safari/WebKit.
2. Open the URL:  data:text/html,<textarea>
3. Click in the textarea to give it focus and get a caret.
4. Begin typing gibberish, but DO NOT hit Return.  DO put spaces in the
gibberish so that the lines may word-wrap.
5. Type until you're in the middle of the third line (the top line will have
scrolled off, and a scrollbar placeholder will have appeared on the right of
the textarea).
6. Tab out of the textarea so it loses focus.  (Use Tab or Shift-Tab.)
7. Tab back into the textarea so it regains focus.  (Use the opposite tab
operation from Step #6.)
8. Hit Cmd-Z to undo the last operation.

Expected results:

The three lines of typing should be undone.

Actual results:

Safari/WebKit crashes.

Notes:

This is also reproducible with a larger textarea like those used for comments
in Bugzilla, but you only need to type two lines of gibberish instead of three
(apparently because the scrollbar area is already defined?).


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.