ASSERTION FAILURE calling SelectionController::setBaseAndExtent

[Geoffrey Garen]

ASSERTION FAILED: !s.base().node() || s.base().node()->document() == m_frame->document()
(/Users/ggaren/Labyrinth/OpenSource/WebCore/editing/SelectionController.cpp:107 void WebCore::SelectionController::setSelection(const WebCore::Selection&, bool, bool, bool))
Program received signal:  "EXC_BAD_ACCESS".

Here's the reduction:

<iframe src="data:text/html, <div id='test' contenteditable='true'>hello world</div>"></iframe>
<script>
window.onload = function() {
    var div = frames[0].document.getElementById('test');
    getSelection().setBaseAndExtent(div, 0, div, 1);
}
</script>

[Mark Rowe (bdash)]

<rdar://problem/4960137>

[Justin Garcia]

You're setting the wrong frame's selection.  You want to:

frames[0].getSelection().setBaseAndExtent(...)

But we probably shouldn't ASSERT.  Maybe we should try to set the right frame's selection if the user does this.

[Justin Garcia]

r19239