[Webkit-unassigned] [Bug 67668] Crashes in WebCore::EditCommand::apply(), DeleteSelectionCommand::doApply()

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=67668





--- Comment #15 from Ryosuke Niwa <rniwa at webkit.org>  2011-09-09 13:29:32 PST ---
(In reply to comment #14)
> DOMSelection* DOMWindow::getSelection()
> {
>     if (!m_selection)
>         m_selection = DOMSelection::create(m_frame);
> ...
> 
> When there is no m_selection on the DOMWindow a new DOMSelection is created. This is the case with all of these that I have stepped through.

Yes, but DOMSelection is just a wrapper for FrameSelection, which is a different object from DOMSelection and is always available on frame.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.