[Webkit-unassigned] [Bug 139303] New: Crash in WebCore::Node::getFlag

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=139303

            Bug ID: 139303
           Summary: Crash in WebCore::Node::getFlag
    Classification: Unclassified
           Product: WebKit
           Version: 528+ (Nightly build)
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: HTML Editing
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: rhodovan.u-szeged at partner.samsung.com
                CC: bdakin at apple.com, hyatt at apple.com
            Blocks: 116980

Created attachment 242636
  --> https://bugs.webkit.org/attachment.cgi?id=242636&action=review
Test case

Load this test:

<li></li>
<li>aaaa</li>
<script>
</script>
<style>
*  {
    -webkit-transition-delay:630s;
    line-height:.0;
}
</style>
<script>
    document.designMode = 'on';
    document.execCommand("selectAll", false, null);
    document.execCommand("insertOrderedList" , true , null);
</script>


Backtrace:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fff98927700 (LWP 19580)]
0x00007ffff27a12ed in WebCore::Node::getFlag (this=0x0, mask=WebCore::Node::IsElementFlag) at ../../Source/WebCore/dom/Node.h:628
628        bool getFlag(NodeFlags mask) const { return m_nodeFlags & mask; }
#0  0x00007ffff27a12ed in WebCore::Node::getFlag (this=0x0, mask=WebCore::Node::IsElementFlag) at ../../Source/WebCore/dom/Node.h:628
#1  0x00007ffff27c0ae9 in WebCore::Node::isElementNode (this=0x0) at ../../Source/WebCore/dom/Node.h:226
#2  0x00007ffff324cb3f in WebCore::isBlockFlowElement (node=0x0) at ../../Source/WebCore/editing/htmlediting.cpp:1242
#3  0x00007ffff31f5e05 in WebCore::InsertListCommand::doApplyForSingleParagraph (this=0x62e770, forceCreateList=true, listTag=..., currentSelection=0x62e950) at ../../Source/WebCore/editing/InsertListCommand.cpp:228
#4  0x00007ffff31f5239 in WebCore::InsertListCommand::doApply (this=0x62e770) at ../../Source/WebCore/editing/InsertListCommand.cpp:163
#5  0x00007ffff3197f25 in WebCore::CompositeEditCommand::apply (this=0x62e770) at ../../Source/WebCore/editing/CompositeEditCommand.cpp:207
#6  0x00007ffff3197cdc in WebCore::applyCommand (command=...) at ../../Source/WebCore/editing/CompositeEditCommand.cpp:167
#7  0x00007ffff31dacbf in WebCore::executeInsertOrderedList (frame=...) at ../../Source/WebCore/editing/EditorCommand.cpp:549
#8  0x00007ffff31de3f9 in WebCore::Editor::Command::execute (this=0x7fffffffbed0, parameter=..., triggeringEvent=0x0) at ../../Source/WebCore/editing/EditorCommand.cpp:1726
#9  0x00007ffff306fbbc in WebCore::Document::execCommand (this=0x475600, commandName=..., userInterface=true, value=...) at ../../Source/WebCore/dom/Document.cpp:4375
#10 0x00007ffff408c28a in WebCore::jsDocumentPrototypeFunctionExecCommand (exec=0x7fffffffbfd0) at DerivedSources/WebCore/JSDocument.cpp:4526
#11 0x00007fff9a5fc0b4 in ?? ()
#12 0x00007fffffffc030 in ?? ()
#13 0x00007fffedb73e7d in llint_entry () from /home/reni/data/REPOS/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20141205/44cc4043/attachment-0002.html>