[Webkit-unassigned] [Bug 129098] WebKit crashes during execution of ReplaceSelectionCommand

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=129098





--- Comment #14 from Ryosuke Niwa <rniwa at webkit.org>  2014-02-25 04:00:08 PST ---
(From update of attachment 224747)
View in context: https://bugs.webkit.org/attachment.cgi?id=224747&action=review

> LayoutTests/editing/execCommand/insertHorizontalRule-into-paragraph-crash-expected.txt:23
> +|   <p>
> +|     contenteditable="true"
> +|     id="testParagraph"
> +|     "Foo"
> +|   <hr>
> +|   <#selection-caret>
> +|   <p>
> +|     contenteditable="true"
> +|     "Bar"

This output is incorrect. The hr element must appear inside a single p element between "Foo" and "Bar".

We need to make insertHorizontalRule fail or simply strip the hr element
in makeInsertedContentRoundTrippableWithHTMLTreeBuilder
when we can't modify the root editable element in cases like this.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.