ASSERT in editing code, ASSERTION FAILED: selection.isCaretOrRange() ASSERTION FAILED: selection.isCaretOrRange() (/Users/eseidel/Projects/WebKit/WebCore/editing/ReplaceSelectionCommand.cpp:594 virtual void WebCore::ReplaceSelectionCommand::doApply()) The commands: doc.execCommand('createLink', 0, '</td>'); doc.execCommand('justifyright', 1, '<script src=https://webkit.org>'); doc.execCommand('cut', 0, 'javascript:1'); doc.execCommand('insertunorderedlist', 1, 'courier'); doc.execCommand('insertunorderedlist', 1, 'courier'); doc.execCommand('insertunorderedlist', 0, ''); doc.execCommand('createLink', 0, '<tr>'); doc.execCommand('insertunorderedlist', 1, '<table>'); doc.execCommand('paste', 1, 'red'); doc.execCommand('insertorderedlist', 1, ''); doc.execCommand('insertparagraph', 0, 'javascript:1'); doc.execCommand('justifycenter', 0, 'https://www.webkit.org'); doc.execCommand('createLink', 1, '<iframe src=about:blank>'); doc.execCommand('indent', 0, 'red'); doc.execCommand('outdent', 0, '</tr>'); Unfortunately my reduction script reduced it far enough that it no longer crashes in Safari, but it does crash in DRT. You'll have to run this test under DRT to see the crash.
The value parameters for most of those calls can probably be removed.
Created attachment 21159 [details] test case (ONLY ASSERTS under DRT in Debug mode)
I still hit this ASSERT with the fuzzer, but not with this test case. I guess I'll close and open a new bug with a new test case.