Bug 19075 – ASSERT in editing code, ASSERTION FAILED: selection.isCaretOrRange()

• Status: RESOLVED
• Resolution: WORKSFORME
• Component: HTML Editing

[Eric Seidel (no email)]

ASSERT in editing code, ASSERTION FAILED: selection.isCaretOrRange()

ASSERTION FAILED: selection.isCaretOrRange()
(/Users/eseidel/Projects/WebKit/WebCore/editing/ReplaceSelectionCommand.cpp:594 virtual void WebCore::ReplaceSelectionCommand::doApply())

The commands:
  doc.execCommand('createLink', 0, '</td>');
  doc.execCommand('justifyright', 1, '<script src=https://webkit.org>');
  doc.execCommand('cut', 0, 'javascript:1');
  doc.execCommand('insertunorderedlist', 1, 'courier');
  doc.execCommand('insertunorderedlist', 1, 'courier');
  doc.execCommand('insertunorderedlist', 0, '');
  doc.execCommand('createLink', 0, '<tr>');
  doc.execCommand('insertunorderedlist', 1, '<table>');
  doc.execCommand('paste', 1, 'red');
  doc.execCommand('insertorderedlist', 1, '');
  doc.execCommand('insertparagraph', 0, 'javascript:1');
  doc.execCommand('justifycenter', 0, 'https://www.webkit.org');
  doc.execCommand('createLink', 1, '<iframe src=about:blank>');
  doc.execCommand('indent', 0, 'red');
  doc.execCommand('outdent', 0, '</tr>');

Unfortunately my reduction script reduced it far enough that it no longer crashes in Safari, but it does crash in DRT.  You'll have to run this test under DRT to see the crash.

[Eric Seidel (no email)]

The value parameters for most of those calls can probably be removed.

[Eric Seidel (no email)]

Created attachment 21159 [details]
test case (ONLY ASSERTS under DRT in Debug mode)

[Eric Seidel (no email)]

I still hit this ASSERT with the fuzzer, but not with this test case.   I guess I'll close and open a new bug with a new test case.