49315 2010-11-10 03:49:35 -0800 chrome.dll!WebCore::ApplyStyleCommand::surroundNodeRangeWithElement ReadAV@NULL (d21e8ab8aa42253ec7e46b595e4cf4fd) 2023-12-30 02:46:33 -0800 1 1 1 Unclassified WebKit DOM 528+ (Nightly build) PC Windows Vista RESOLVED WONTFIX http://code.google.com/p/chromium/issues/detail?id=62654 P1 Normal --- 42436 1 skylined webkit-unassigned annevk eric rniwa oldest_to_newest 307289 0 73482 skylined 2010-11-10 03:49:35 -0800 Created attachment 73482 Repro for crash 1 Repro: <html> <head> <script> function go() { document.designMode= "on"; document.execCommand("selectall", false, "eory"); document.execCommand("italic", false); document.execCommand("InsertOrderedList", false, "Tue"); document.execCommand("inserthorizontalrule", false, "966BF0"); document.execCommand("InsertOrderedList", false, true); document.execCommand("insertimage", false, NaN); document.execCommand("insertorderedlist", false, Infinity); document.execCommand("outdent", false, "chroextEEExxWWWWWWWWWWWWWRRRR444444444"); document.execCommand("createlink", false, true); document.execCommand("indent", false, "ht//examWWWWWWWWWWWWWWWWWWWWWWWWWW3333333333"); document.execCommand("InsertNewlineInQuotedContent", false); document.execCommand("delete", false, "-0x00003"); document.execCommand("InsertParagraph", false); document.execCommand("outdent", false, "ps:xample.com"); document.execCommand("outdent", false, "ps:xample.com"); location.reload(); } </script> </head> <body onload="go()"> <pre style="white-space: pre-wrap;">x</pre> </body> </html> id: chrome.dll!WebCore::ApplyStyleCommand::surroundNodeRangeWithElement ReadAV@NULL (d21e8ab8aa42253ec7e46b595e4cf4fd) description: Attempt to read from unallocated NULL pointer+0x1C in chrome.dll!WebCore::ApplyStyleCommand::surroundNodeRangeWithElement application: Chromium 9.0.571.0 stack: chrome.dll!WebCore::ApplyStyleCommand::surroundNodeRangeWithElement chrome.dll!WebCore::ApplyStyleCommand::addInlineStyleIfNeeded chrome.dll!WebCore::ApplyStyleCommand::applyInlineStyleToNodeRange chrome.dll!WebCore::ApplyStyleCommand::fixRangeAndApplyInlineStyle chrome.dll!WebCore::ApplyStyleCommand::applyInlineStyle chrome.dll!WebCore::ApplyStyleCommand::doApply chrome.dll!WebCore::EditCommand::apply chrome.dll!WebCore::CompositeEditCommand::applyCommandToComposite chrome.dll!WebCore::CompositeEditCommand::applyStyle chrome.dll!WebCore::CompositeEditCommand::moveParagraphs chrome.dll!WebCore::InsertListCommand::unlistifyParagraph chrome.dll!WebCore::InsertListCommand::doApplyForSingleParagraph chrome.dll!WebCore::InsertListCommand::doApply chrome.dll!WebCore::EditCommand::apply chrome.dll!WebCore::CompositeEditCommand::applyCommandToComposite chrome.dll!WebCore::IndentOutdentCommand::outdentParagraph chrome.dll!WebCore::IndentOutdentCommand::outdentRegion chrome.dll!WebCore::ApplyBlockElementCommand::doApply chrome.dll!WebCore::EditCommand::apply chrome.dll!WebCore::applyCommand chrome.dll!WebCore::executeOutdent chrome.dll!WebCore::Editor::Command::execute chrome.dll!WebCore::Document::execCommand chrome.dll!WebCore::DocumentInternal::execCommandCallback chrome.dll!v8::internal::HandleApiCallHelper<...> chrome.dll!v8::internal::Builtin_HandleApiCall chrome.dll!v8::internal::Invoke chrome.dll!v8::internal::Execution::Call ... A variation of this can be triggered by changing the <body> in the repro to: <body onload="go()" style="white-space: pre-wrap;"> x </body> That crash is: id: chrome.dll!WebCore::RangeBoundaryPoint::toPosition ReadAV@NULL (cf0d0f28bc56f2591cc74f71b46036ea) description: Attempt to read from unallocated NULL pointer+0xC in chrome.dll!WebCore::RangeBoundaryPoint::toPosition application: Chromium 9.0.571.0 stack: chrome.dll!WebCore::RangeBoundaryPoint::toPosition chrome.dll!WebCore::InsertListCommand::doApply chrome.dll!WebCore::EditCommand::apply chrome.dll!WebCore::applyCommand chrome.dll!WebCore::executeInsertOrderedList chrome.dll!WebCore::Editor::Command::execute chrome.dll!WebCore::Document::execCommand chrome.dll!WebCore::DocumentInternal::execCommandCallback chrome.dll!v8::internal::HandleApiCallHelper<...> chrome.dll!v8::internal::Builtin_HandleApiCall chrome.dll!v8::internal::Invoke chrome.dll!v8::internal::Execution::Call ... 307290 1 73483 skylined 2010-11-10 03:52:52 -0800 Created attachment 73483 Repro for crash 2 (infinite loop) 307383 2 eric 2010-11-10 09:28:09 -0800 Thanks SkyLined. 307439 3 73511 rniwa 2010-11-10 11:01:27 -0800 Created attachment 73511 reduction 307525 4 rniwa 2010-11-10 13:42:49 -0800 This bug is really hard to fix. 307530 5 rniwa 2010-11-10 13:51:08 -0800 Making the following change in unlistifyParagraph will fix my reduction: - VisiblePosition insertionPoint = VisiblePosition(Position(placeholder.get(), 0)); + VisiblePosition insertionPoint = VisiblePosition(positionAfterNode(placeholder.get())); + + // insertPoint has collapsed; i.e. it's the end of line perhaps because li & ol had display: inline + if (endOfParagraph(insertionPoint) == endOfParagraph(end)) { + placeholder = createBreakElement(document()); + insertNodeAfter(placeholder, nodeToInsert); + insertionPoint = VisiblePosition(Position(placeholder.get(), 0)); + ASSERT(endOfParagraph(insertionPoint) != endOfParagraph(end)); + } + However, reproduction 2 (infinite loop case) still crashes and fixing this second crash requires overhaul of many editing functions. 412196 6 skylined 2011-05-30 05:42:11 -0700 Ryosuke, does this mean it'll cost too much time to fix at the moment? 414536 7 rniwa 2011-06-02 16:38:04 -0700 (In reply to comment #6) > Ryosuke, does this mean it'll cost too much time to fix at the moment? Yeah, I really appreciate your help for filing these bugs but I don't think fixing these crashes is helpful at the moment because the design is inherently fragile. We have to re-design IndentOutdentCommand and InsertListCommand rather than cherry-picking these crashes. 414796 8 skylined 2011-06-03 05:30:49 -0700 In that case, should we merge these into a meta bug? 2002290 9 annevk 2023-12-30 02:46:33 -0800 Chromium-specific. 73482 2010-11-10 03:49:35 -0800 2010-11-10 03:49:35 -0800 Repro for crash 1 repro1.html text/html 1219 skylined PGh0bWw+CiAgPGhlYWQ+CiAgICA8c2NyaXB0PgogICAgICBmdW5jdGlvbiBnbygpIHsKICAgICAg ICBkb2N1bWVudC5kZXNpZ25Nb2RlPSAib24iOwogICAgICAgIGRvY3VtZW50LmV4ZWNDb21tYW5k KCJzZWxlY3RhbGwiLCBmYWxzZSwgImVvcnkiKTsKICAgICAgICBkb2N1bWVudC5leGVjQ29tbWFu ZCgiaXRhbGljIiwgZmFsc2UpOwogICAgICAgIGRvY3VtZW50LmV4ZWNDb21tYW5kKCJJbnNlcnRP cmRlcmVkTGlzdCIsIGZhbHNlLCAiVHVlIik7CiAgICAgICAgZG9jdW1lbnQuZXhlY0NvbW1hbmQo Imluc2VydGhvcml6b250YWxydWxlIiwgZmFsc2UsICI5NjZCRjAiKTsKICAgICAgICBkb2N1bWVu dC5leGVjQ29tbWFuZCgiSW5zZXJ0T3JkZXJlZExpc3QiLCBmYWxzZSwgdHJ1ZSk7CiAgICAgICAg ZG9jdW1lbnQuZXhlY0NvbW1hbmQoImluc2VydGltYWdlIiwgZmFsc2UsIE5hTik7CiAgICAgICAg ZG9jdW1lbnQuZXhlY0NvbW1hbmQoImluc2VydG9yZGVyZWRsaXN0IiwgZmFsc2UsIEluZmluaXR5 KTsKICAgICAgICBkb2N1bWVudC5leGVjQ29tbWFuZCgib3V0ZGVudCIsIGZhbHNlLCAiY2hyb2V4 dEVFRXh4V1dXV1dXV1dXV1dXV1JSUlI0NDQ0NDQ0NDQiKTsKICAgICAgICBkb2N1bWVudC5leGVj Q29tbWFuZCgiY3JlYXRlbGluayIsIGZhbHNlLCB0cnVlKTsKICAgICAgICBkb2N1bWVudC5leGVj Q29tbWFuZCgiaW5kZW50IiwgZmFsc2UsICJodC8vZXhhbVdXV1dXV1dXV1dXV1dXV1dXV1dXV1dX V1dXMzMzMzMzMzMzMyIpOwogICAgICAgIGRvY3VtZW50LmV4ZWNDb21tYW5kKCJJbnNlcnROZXds aW5lSW5RdW90ZWRDb250ZW50IiwgZmFsc2UpOwogICAgICAgIGRvY3VtZW50LmV4ZWNDb21tYW5k KCJkZWxldGUiLCBmYWxzZSwgIi0weDAwMDAzIik7CiAgICAgICAgZG9jdW1lbnQuZXhlY0NvbW1h bmQoIkluc2VydFBhcmFncmFwaCIsIGZhbHNlKTsKICAgICAgICBkb2N1bWVudC5leGVjQ29tbWFu ZCgib3V0ZGVudCIsIGZhbHNlLCAicHM6eGFtcGxlLmNvbSIpOwogICAgICAgIGRvY3VtZW50LmV4 ZWNDb21tYW5kKCJvdXRkZW50IiwgZmFsc2UsICJwczp4YW1wbGUuY29tIik7CiAgICAgICAgbG9j YXRpb24ucmVsb2FkKCk7CiAgICAgIH0KICAgIDwvc2NyaXB0PgogIDwvaGVhZD4KICA8Ym9keSBv bmxvYWQ9ImdvKCkiPgogICAgPHByZSBzdHlsZT0id2hpdGUtc3BhY2U6IHByZS13cmFwOyI+eDwv cHJlPgogIDwvYm9keT4KPC9odG1sPg== 73483 2010-11-10 03:52:52 -0800 2010-11-10 13:49:27 -0800 Repro for crash 2 (infinite loop) repro2.html text/html 1208 skylined PGh0bWw+CiAgPGhlYWQ+CiAgICA8c2NyaXB0PgogICAgICBmdW5jdGlvbiBnbygpIHsKICAgICAg ICBkb2N1bWVudC5kZXNpZ25Nb2RlPSAib24iOwogICAgICAgIGRvY3VtZW50LmV4ZWNDb21tYW5k KCJzZWxlY3RhbGwiLCBmYWxzZSwgImVvcnkiKTsKICAgICAgICBkb2N1bWVudC5leGVjQ29tbWFu ZCgiaXRhbGljIiwgZmFsc2UpOwogICAgICAgIGRvY3VtZW50LmV4ZWNDb21tYW5kKCJJbnNlcnRP cmRlcmVkTGlzdCIsIGZhbHNlLCAiVHVlIik7CiAgICAgICAgZG9jdW1lbnQuZXhlY0NvbW1hbmQo Imluc2VydGhvcml6b250YWxydWxlIiwgZmFsc2UsICI5NjZCRjAiKTsKICAgICAgICBkb2N1bWVu dC5leGVjQ29tbWFuZCgiSW5zZXJ0T3JkZXJlZExpc3QiLCBmYWxzZSwgdHJ1ZSk7CiAgICAgICAg ZG9jdW1lbnQuZXhlY0NvbW1hbmQoImluc2VydGltYWdlIiwgZmFsc2UsIE5hTik7CiAgICAgICAg ZG9jdW1lbnQuZXhlY0NvbW1hbmQoImluc2VydG9yZGVyZWRsaXN0IiwgZmFsc2UsIEluZmluaXR5 KTsKICAgICAgICBkb2N1bWVudC5leGVjQ29tbWFuZCgib3V0ZGVudCIsIGZhbHNlLCAiY2hyb2V4 dEVFRXh4V1dXV1dXV1dXV1dXV1JSUlI0NDQ0NDQ0NDQiKTsKICAgICAgICBkb2N1bWVudC5leGVj Q29tbWFuZCgiY3JlYXRlbGluayIsIGZhbHNlLCB0cnVlKTsKICAgICAgICBkb2N1bWVudC5leGVj Q29tbWFuZCgiaW5kZW50IiwgZmFsc2UsICJodC8vZXhhbVdXV1dXV1dXV1dXV1dXV1dXV1dXV1dX V1dXMzMzMzMzMzMzMyIpOwogICAgICAgIGRvY3VtZW50LmV4ZWNDb21tYW5kKCJJbnNlcnROZXds aW5lSW5RdW90ZWRDb250ZW50IiwgZmFsc2UpOwogICAgICAgIGRvY3VtZW50LmV4ZWNDb21tYW5k KCJkZWxldGUiLCBmYWxzZSwgIi0weDAwMDAzIik7CiAgICAgICAgZG9jdW1lbnQuZXhlY0NvbW1h bmQoIkluc2VydFBhcmFncmFwaCIsIGZhbHNlKTsKICAgICAgICBkb2N1bWVudC5leGVjQ29tbWFu ZCgib3V0ZGVudCIsIGZhbHNlLCAicHM6eGFtcGxlLmNvbSIpOwogICAgICAgIGRvY3VtZW50LmV4 ZWNDb21tYW5kKCJvdXRkZW50IiwgZmFsc2UsICJwczp4YW1wbGUuY29tIik7CiAgICAgICAgbG9j YXRpb24ucmVsb2FkKCk7CiAgICAgIH0KICAgIDwvc2NyaXB0PgogIDwvaGVhZD4KICA8Ym9keSBv bmxvYWQ9ImdvKCkiIHN0eWxlPSJ3aGl0ZS1zcGFjZTogcHJlLXdyYXA7Ij4KICAgIHgKICA8L2Jv ZHk+CjwvaHRtbD4= 73511 2010-11-10 11:01:27 -0800 2010-11-10 11:01:27 -0800 reduction bug49315.html text/html 1748 rniwa PGh0bWw+IAo8aGVhZD4gCjxzY3JpcHQ+IAogIGZ1bmN0aW9uIGdvKCkgewogICAgZG9jdW1lbnQu ZGVzaWduTW9kZT0gIm9uIjsKICAgIHdpbmRvdy5nZXRTZWxlY3Rpb24oKS5zZXRQb3NpdGlvbihk b2N1bWVudC5nZXRFbGVtZW50c0J5VGFnTmFtZSgnYScpWzBdLmZpcnN0Q2hpbGQsIDApOwogICAg ZG9jdW1lbnQuZXhlY0NvbW1hbmQoIkluc2VydE9yZGVyZWRMaXN0IiwgZmFsc2UsIGZhbHNlKTsK LyogICAgZG9jdW1lbnQuZXhlY0NvbW1hbmQoInNlbGVjdGFsbCIsIGZhbHNlLCAiZW9yeSIpOwog ICAgZG9jdW1lbnQuZXhlY0NvbW1hbmQoIml0YWxpYyIsIGZhbHNlKTsKICAgIGRvY3VtZW50LmV4 ZWNDb21tYW5kKCJJbnNlcnRPcmRlcmVkTGlzdCIsIGZhbHNlLCAiVHVlIik7CiAgICBkb2N1bWVu dC5leGVjQ29tbWFuZCgiaW5zZXJ0aG9yaXpvbnRhbHJ1bGUiLCBmYWxzZSwgIjk2NkJGMCIpOwog ICAgZG9jdW1lbnQuZXhlY0NvbW1hbmQoIkluc2VydE9yZGVyZWRMaXN0IiwgZmFsc2UsIHRydWUp OwogICAgZG9jdW1lbnQuZXhlY0NvbW1hbmQoImluc2VydGltYWdlIiwgZmFsc2UsIE5hTik7CiAg ICBkb2N1bWVudC5leGVjQ29tbWFuZCgiaW5zZXJ0b3JkZXJlZGxpc3QiLCBmYWxzZSwgSW5maW5p dHkpOwogICAgZG9jdW1lbnQuZXhlY0NvbW1hbmQoIm91dGRlbnQiLCBmYWxzZSwgImNocm9leHRF RUV4eFdXV1dXV1dXV1dXV1dSUlJSNDQ0NDQ0NDQ0Iik7CiAgICBkb2N1bWVudC5leGVjQ29tbWFu ZCgiY3JlYXRlbGluayIsIGZhbHNlLCB0cnVlKTsKICAgIGRvY3VtZW50LmV4ZWNDb21tYW5kKCJp bmRlbnQiLCBmYWxzZSwgImh0Ly9leGFtV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1czMzMzMzMz MzMzIik7CiAgICBkb2N1bWVudC5leGVjQ29tbWFuZCgiSW5zZXJ0TmV3bGluZUluUXVvdGVkQ29u dGVudCIsIGZhbHNlKTsKICAgIGRvY3VtZW50LmV4ZWNDb21tYW5kKCJkZWxldGUiLCBmYWxzZSwg Ii0weDAwMDAzIik7CiAgICBkb2N1bWVudC5leGVjQ29tbWFuZCgiSW5zZXJ0UGFyYWdyYXBoIiwg ZmFsc2UpOwogICAgZG9jdW1lbnQuZXhlY0NvbW1hbmQoIm91dGRlbnQiLCBmYWxzZSwgInBzOnhh bXBsZS5jb20iKTsKICAgIGRvY3VtZW50LmV4ZWNDb21tYW5kKCJvdXRkZW50IiwgZmFsc2UsICJw czp4YW1wbGUuY29tIik7CiAgICBsb2NhdGlvbi5yZWxvYWQoKTsqLwogIH0KPC9zY3JpcHQ+IAo8 L2hlYWQ+Cjxib2R5IG9ubG9hZD0iZ28oKSIgc3R5bGU9IndoaXRlLXNwYWNlOiBwcmUtd3JhcDsi Cj48YmxvY2txdW90ZSBjbGFzcz0id2Via2l0LWluZGVudC1ibG9ja3F1b3RlIiBzdHlsZT0ibWFy Z2luOiAwIDAgMCA0MHB4OyBib3JkZXI6IG5vbmU7IHBhZGRpbmc6IDBweDsiCiAgICA+PHNwYW4g Y2xhc3M9IkFwcGxlLXN0eWxlLXNwYW4iIHN0eWxlPSJ3aGl0ZS1zcGFjZTogcHJlLXdyYXA7Ij48 aT48c3BhbiBjbGFzcz0iQXBwbGUtc3R5bGUtc3BhbiIgc3R5bGU9ImZvbnQtc3R5bGU6IG5vcm1h bDsiCiAgICAgICAgPjxpPjxvbCBzdHlsZT0iZGlzcGxheTogaW5saW5lICFpbXBvcnRhbnQ7Ij48 bGkgc3R5bGU9ImRpc3BsYXk6IGlubGluZSAhaW1wb3J0YW50OyIKICAgICAgICAgICAgPjxzcGFu IGNsYXNzPSJBcHBsZS1zdHlsZS1zcGFuIiBzdHlsZT0iZm9udC1zdHlsZTogbm9ybWFsOyI+PGk+ PGE+ZTwvYT48L2k+PC9zcGFuCiAgICAgICAgPjwvbGk+PC9vbD48L2kKICAgID48L3NwYW4+PC9p Pjwvc3Bhbj48L2Jsb2NrcXVvdGU+PC9ib2R5PiAKPC9odG1sPgo=