[Webkit-unassigned] [Bug 48104] New: Crash in insertText command

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=48104

           Summary: Crash in insertText command
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: All
        OS/Version: All
            Status: NEW
          Keywords: HasReduction, NeedsRadar
          Severity: Normal
          Priority: P1
         Component: HTML Editing
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: rniwa at webkit.org
                CC: tony at chromium.org, ojan at chromium.org, enrica at apple.com


Created an attachment (id=71511)
 --> (https://bugs.webkit.org/attachment.cgi?id=71511&action=review)
demo

Crash occurs when removing format from:
<div style="display: table; position: absolute;">
<div contenteditable style="display: table-cell;"><br>hello<br></div>
</div>

#0    0x10159164a in WebCore::CompositeEditCommand::insertNodeAt at CompositeEditCommand.cpp:161
#1    0x1019faeb4 in WebCore::InsertTextCommand::prepareForTextInsertion at InsertTextCommand.cpp:63
#2    0x1019fb42e in WebCore::InsertTextCommand::input at InsertTextCommand.cpp:167
#3    0x101592149 in WebCore::CompositeEditCommand::inputText at CompositeEditCommand.cpp:313
#4    0x101e26735 in WebCore::RemoveFormatCommand::doApply at RemoveFormatCommand.cpp:83

http://crbug.com/53392

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.