[Webkit-unassigned] [Bug 44176] New: WebCore::createFragmentFromMarkup ReadAV at NULL
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Wed Aug 18 07:32:32 PDT 2010
https://bugs.webkit.org/show_bug.cgi?id=44176
Summary: WebCore::createFragmentFromMarkup ReadAV at NULL
Product: WebKit
Version: 528+ (Nightly build)
Platform: PC
OS/Version: Windows Vista
Status: NEW
Severity: Normal
Priority: P1
Component: HTML DOM
AssignedTo: webkit-unassigned at lists.webkit.org
ReportedBy: skylined at chromium.org
CC: eric at webkit.org
Created an attachment (id=64708)
--> (https://bugs.webkit.org/attachment.cgi?id=64708)
Repro
The following repro causes a NULL pointer crash in latest Chromium:
<body onload="
document.designMode='on';
document.execCommand('selectall');
document.execCommand('InsertLineBreak');
document.open();
document.execCommand('Undo');
document.execCommand('InsertHTML', false, 'x');
">
id: WebCore::createFragmentFromMarkup ReadAV at NULL (0aeb58d38090b34986cfab3dd85965ec)
description: Attempt to read from NULL pointer in WebCore::createFragmentFromMarkup
stack: WebCore::createFragmentFromMarkup
WebCore::executeInsertHTML
WebCore::Editor::Command::execute
WebCore::Document::execCommand
WebCore::DocumentInternal::execCommandCallback
v8::internal::HandleApiCallHelper<...>
v8::internal::Builtin_HandleApiCall
v8::internal::Invoke
v8::internal::Execution::Call
...
--
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
More information about the webkit-unassigned
mailing list