[Webkit-unassigned] [Bug 49315] New: chrome.dll!WebCore::ApplyStyleCommand::surroundNodeRangeWithElement ReadAV at NULL (d21e8ab8aa42253ec7e46b595e4cf4fd)
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Wed Nov 10 03:49:35 PST 2010
https://bugs.webkit.org/show_bug.cgi?id=49315
Summary: chrome.dll!WebCore::ApplyStyleCommand::surroundNodeRan
geWithElement ReadAV at NULL
(d21e8ab8aa42253ec7e46b595e4cf4fd)
Product: WebKit
Version: 528+ (Nightly build)
Platform: PC
URL: http://code.google.com/p/chromium/issues/detail?id=626
54
OS/Version: Windows Vista
Status: NEW
Severity: Normal
Priority: P1
Component: HTML DOM
AssignedTo: webkit-unassigned at lists.webkit.org
ReportedBy: skylined at chromium.org
CC: eric at webkit.org
Created an attachment (id=73482)
--> (https://bugs.webkit.org/attachment.cgi?id=73482&action=review)
Repro for crash 1
Repro:
<html>
<head>
<script>
function go() {
document.designMode= "on";
document.execCommand("selectall", false, "eory");
document.execCommand("italic", false);
document.execCommand("InsertOrderedList", false, "Tue");
document.execCommand("inserthorizontalrule", false, "966BF0");
document.execCommand("InsertOrderedList", false, true);
document.execCommand("insertimage", false, NaN);
document.execCommand("insertorderedlist", false, Infinity);
document.execCommand("outdent", false, "chroextEEExxWWWWWWWWWWWWWRRRR444444444");
document.execCommand("createlink", false, true);
document.execCommand("indent", false, "ht//examWWWWWWWWWWWWWWWWWWWWWWWWWW3333333333");
document.execCommand("InsertNewlineInQuotedContent", false);
document.execCommand("delete", false, "-0x00003");
document.execCommand("InsertParagraph", false);
document.execCommand("outdent", false, "ps:xample.com");
document.execCommand("outdent", false, "ps:xample.com");
location.reload();
}
</script>
</head>
<body onload="go()">
<pre style="white-space: pre-wrap;">x</pre>
</body>
</html>
id: chrome.dll!WebCore::ApplyStyleCommand::surroundNodeRangeWithElement ReadAV at NULL (d21e8ab8aa42253ec7e46b595e4cf4fd)
description: Attempt to read from unallocated NULL pointer+0x1C in chrome.dll!WebCore::ApplyStyleCommand::surroundNodeRangeWithElement
application: Chromium 9.0.571.0
stack: chrome.dll!WebCore::ApplyStyleCommand::surroundNodeRangeWithElement
chrome.dll!WebCore::ApplyStyleCommand::addInlineStyleIfNeeded
chrome.dll!WebCore::ApplyStyleCommand::applyInlineStyleToNodeRange
chrome.dll!WebCore::ApplyStyleCommand::fixRangeAndApplyInlineStyle
chrome.dll!WebCore::ApplyStyleCommand::applyInlineStyle
chrome.dll!WebCore::ApplyStyleCommand::doApply
chrome.dll!WebCore::EditCommand::apply
chrome.dll!WebCore::CompositeEditCommand::applyCommandToComposite
chrome.dll!WebCore::CompositeEditCommand::applyStyle
chrome.dll!WebCore::CompositeEditCommand::moveParagraphs
chrome.dll!WebCore::InsertListCommand::unlistifyParagraph
chrome.dll!WebCore::InsertListCommand::doApplyForSingleParagraph
chrome.dll!WebCore::InsertListCommand::doApply
chrome.dll!WebCore::EditCommand::apply
chrome.dll!WebCore::CompositeEditCommand::applyCommandToComposite
chrome.dll!WebCore::IndentOutdentCommand::outdentParagraph
chrome.dll!WebCore::IndentOutdentCommand::outdentRegion
chrome.dll!WebCore::ApplyBlockElementCommand::doApply
chrome.dll!WebCore::EditCommand::apply
chrome.dll!WebCore::applyCommand
chrome.dll!WebCore::executeOutdent
chrome.dll!WebCore::Editor::Command::execute
chrome.dll!WebCore::Document::execCommand
chrome.dll!WebCore::DocumentInternal::execCommandCallback
chrome.dll!v8::internal::HandleApiCallHelper<...>
chrome.dll!v8::internal::Builtin_HandleApiCall
chrome.dll!v8::internal::Invoke
chrome.dll!v8::internal::Execution::Call
...
A variation of this can be triggered by changing the <body> in the repro to:
<body onload="go()" style="white-space: pre-wrap;">
x
</body>
That crash is:
id: chrome.dll!WebCore::RangeBoundaryPoint::toPosition ReadAV at NULL (cf0d0f28bc56f2591cc74f71b46036ea)
description: Attempt to read from unallocated NULL pointer+0xC in chrome.dll!WebCore::RangeBoundaryPoint::toPosition
application: Chromium 9.0.571.0
stack: chrome.dll!WebCore::RangeBoundaryPoint::toPosition
chrome.dll!WebCore::InsertListCommand::doApply
chrome.dll!WebCore::EditCommand::apply
chrome.dll!WebCore::applyCommand
chrome.dll!WebCore::executeInsertOrderedList
chrome.dll!WebCore::Editor::Command::execute
chrome.dll!WebCore::Document::execCommand
chrome.dll!WebCore::DocumentInternal::execCommandCallback
chrome.dll!v8::internal::HandleApiCallHelper<...>
chrome.dll!v8::internal::Builtin_HandleApiCall
chrome.dll!v8::internal::Invoke
chrome.dll!v8::internal::Execution::Call
...
--
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
More information about the webkit-unassigned
mailing list