[Webkit-unassigned] [Bug 88502] New: [Shadow][Editing] document.execCommand('bold') twice will cause crash in Shadow DOM.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=88502

           Summary: [Shadow][Editing] document.execCommand('bold') twice
                    will cause crash in Shadow DOM.
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: HTML Editing
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: shinyak at chromium.org
            Blocks: 82697


HTML:
<div contenteditable>
    BEFORE HOST
    <div id="host">    <span contenteditable="false">not editable<span></div>
    AFTER HOST
</div>

Shadow DOM for host:
<div id="shadow-host"><span contenteditable>SHADOW (BEFORE)</span><shadow></shadow>SHADOW (AFTER)</div>

Shadow DOM for shadow-host
<div contenteditable>NESTED BEFORE<shadow></shadow><input></input>NESTED AFTER</div>


Select from NESTED BEFORE to NESTED AFTER, then document.execCommand('bold') twice. It causes a crash.

ASSERTION FAILED: !m_insertedChild->parentNode()
InsertNodeBeforeCommand.cpp(41) : InsertNodeBeforeCommand

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.