123732 2013-11-04 03:08:08 -0800 ASSERTION FAILED: !m_insertChild->parentNode() in WebCore::InsertNodeBeforeCommand::InsertNodeBeforeCommand 2022-11-17 04:48:46 -0800 1 1 1 Unclassified WebKit HTML Editing 528+ (Nightly build) Unspecified Unspecified NEW https://bugs.webkit.org/show_bug.cgi?id=239533 InRadar P2 Normal --- 116980 1 rhodovan.u-szeged webkit-unassigned bfulgham darin noam sullivan webkit-bug-importer oldest_to_newest 946596 0 215905 rhodovan.u-szeged 2013-11-04 03:08:08 -0800 Created attachment 215905 Test case The failing test: <details></details> <font>A</font> <style></style> <iframe onload=" document.designMode='on'; document.execCommand('selectall'); document.execCommand('italic'); document.execCommand('RemoveFormat');" seamless=" "> </iframe> The backtrace: Program received signal SIGSEGV, Segmentation fault. [Switching to LWP 21412] 0x00007ffff4af0ac1 in WTFCrash () at /home/reni/Data/REPOS/webkitnix/Source/WTF/wtf/Assertions.cpp:342 342 *(int *)(uintptr_t)0xbbadbeef = 0; (gdb) bt #0 0x00007ffff4af0ac1 in WTFCrash () at /home/reni/Data/REPOS/webkitnix/Source/WTF/wtf/Assertions.cpp:342 #1 0x00007ffff335e245 in WebCore::InsertNodeBeforeCommand::InsertNodeBeforeCommand (this=0x8326a0, insertChild=<incomplete type>, refChild=<incomplete type>, shouldAssumeContentIsAlwaysEditable=WebCore::DoNotAssumeContentIsAlwaysEditable) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/InsertNodeBeforeCommand.cpp:44 #2 0x00007ffff3318759 in WebCore::InsertNodeBeforeCommand::create (childToInsert=<incomplete type>, childToInsertBefore=<incomplete type>, shouldAssumeContentIsAlwaysEditable=WebCore::DoNotAssumeContentIsAlwaysEditable) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/InsertNodeBeforeCommand.h:38 #3 0x00007ffff3310118 in WebCore::CompositeEditCommand::insertNodeBefore (this=0x832020, insertChild=<incomplete type>, refChild=<incomplete type>, shouldAssumeContentIsAlwaysEditable=WebCore::DoNotAssumeContentIsAlwaysEditable) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/CompositeEditCommand.cpp:329 #4 0x00007ffff336b815 in WebCore::RemoveNodePreservingChildrenCommand::doApply (this=0x832020) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/RemoveNodePreservingChildrenCommand.cpp:52 #5 0x00007ffff330fb3c in WebCore::CompositeEditCommand::applyCommandToComposite (this=0x821650, prpCommand=<incomplete type>) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/CompositeEditCommand.cpp:262 #6 0x00007ffff3310ae0 in WebCore::CompositeEditCommand::removeNodePreservingChildren (this=0x821650, node=<incomplete type>, shouldAssumeContentIsAlwaysEditable=WebCore::DoNotAssumeContentIsAlwaysEditable) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/CompositeEditCommand.cpp:405 #7 0x00007ffff33044d5 in WebCore::ApplyStyleCommand::removeInlineStyleFromElement (this=0x821650, style=0x831690, element=<incomplete type>, mode=WebCore::ApplyStyleCommand::RemoveIfNeeded, extractedStyle=0x74add0) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/ApplyStyleCommand.cpp:890 #8 0x00007ffff3305175 in WebCore::ApplyStyleCommand::pushDownInlineStyleAroundNode (this=0x821650, style=0x831690, targetNode=0x8bcbd0) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/ApplyStyleCommand.cpp:1051 #9 0x00007ffff33057c3 in WebCore::ApplyStyleCommand::removeInlineStyle (this=0x821650, style=0x831690, start=..., end=...) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/ApplyStyleCommand.cpp:1104 #10 0x00007ffff3302a12 in WebCore::ApplyStyleCommand::applyInlineStyle (this=0x821650, style=0x831690) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/ApplyStyleCommand.cpp:630 #11 0x00007ffff32ffe57 in WebCore::ApplyStyleCommand::doApply (this=0x821650) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/ApplyStyleCommand.cpp:220 #12 0x00007ffff330fb3c in WebCore::CompositeEditCommand::applyCommandToComposite (this=0x831290, prpCommand=<incomplete type>) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/CompositeEditCommand.cpp:262 #13 0x00007ffff336afc5 in WebCore::RemoveFormatCommand::doApply (this=0x831290) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/RemoveFormatCommand.cpp:92 #14 0x00007ffff330f8fc in WebCore::CompositeEditCommand::apply (this=0x831290) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/CompositeEditCommand.cpp:211 #15 0x00007ffff330f6fc in WebCore::applyCommand (command=<incomplete type>) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/CompositeEditCommand.cpp:170 #16 0x00007ffff3333335 in WebCore::Editor::removeFormattingAndStyle (this=0x7a1e60) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/Editor.cpp:700 #17 0x00007ffff3347652 in WebCore::executeRemoveFormat (frame=...) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/EditorCommand.cpp:977 #18 0x00007ffff33491af in WebCore::Editor::Command::execute (this=0x7fffffffa810, parameter=..., triggeringEvent=0x0) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/EditorCommand.cpp:1713 #19 0x00007ffff32106ac in WebCore::Document::execCommand (this=0x81b610, commandName=..., userInterface=false, value=...) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/dom/Document.cpp:4110 #20 0x00007ffff3fab309 in WebCore::jsDocumentPrototypeFunctionExecCommand (exec=0x7fffa37fef50) at /home/reni/Data/REPOS/webkitnix/WebKitBuild/Debug/DerivedSources/WebCore/JSDocument.cpp:2705 #21 0x00007fffaa282105 in ?? () #22 0x00007fffffffa950 in ?? () #23 0x00007ffff4875638 in llint_op_call () from /home/reni/Data/REPOS/webkitnix/WebKitBuild/Debug/lib/libWebKitNix.so.0 #24 0x00007fffaa282940 in ?? () #25 0x0000000000689dd8 in ?? () #26 0x0000000000000001 in ?? () #27 0x0000000000000001 in ?? () #28 0x00000000ffffffff in ?? () ---Type <return> to continue, or q <return> to quit--- #29 0x0000000000000000 in ?? () 1173728 1 273733 rhodovan.u-szeged 2016-03-11 08:13:33 -0800 Created attachment 273733 Test case New test case. Checked on: OS: Mac OS X 10.11.1 (x86_64), x86_64 Build: ASAN debug Version: ecad464 1217097 2 bfulgham 2016-08-03 13:17:20 -0700 This still occurs under r204037. 1217098 3 webkit-bug-importer 2016-08-03 13:19:02 -0700 <rdar://problem/27684325> 215905 2013-11-04 03:08:08 -0800 2016-03-11 08:13:33 -0800 Test case lastCrash.html text/html 284 rhodovan.u-szeged PGRldGFpbHM+PC9kZXRhaWxzPgo8Zm9udD5BPC9mb250Pgo8c3R5bGU+PC9zdHlsZT4KPGlmcmFt ZSBvbmxvYWQ9IiAgIAoJCWRvY3VtZW50LmRlc2lnbk1vZGU9JmFwb3M7b24mYXBvczs7ICAgICAK CQlkb2N1bWVudC5leGVjQ29tbWFuZCgmYXBvcztzZWxlY3RhbGwmYXBvczspOyAgICAgCgkJZG9j dW1lbnQuZXhlY0NvbW1hbmQoJmFwb3M7aXRhbGljJmFwb3M7KTsKCQlkb2N1bWVudC5leGVjQ29t bWFuZCgmYXBvcztSZW1vdmVGb3JtYXQmYXBvczspOyIgc2VhbWxlc3M9IiAiPgo8L2lmcmFtZT4= 273733 2016-03-11 08:13:33 -0800 2016-03-11 08:13:33 -0800 Test case test.html text/html 205 rhodovan.u-szeged PHNjcmlwdD4Kd2luZG93Lm9ubG9hZCA9IGZ1bmN0aW9uKCkgewogICAgZG9jdW1lbnQuZXhlY0Nv bW1hbmQoInNlbGVjdEFsbCIpOwogICAgZG9jdW1lbnQuZXhlY0NvbW1hbmQoInJlbW92ZUZvcm1h dCIpOwp9Cjwvc2NyaXB0Pgo8aHRtbCBjb250ZW50ZWRpdGFibGU9InBsYWludGV4dC1vbmx5Ij4K PHByZT4KPHMgY29udGVudGVkaXRhYmxlPSJmYWxzZSI+Cg==