127339 2014-01-21 05:02:31 -0800 ASSERTION FAILED: s.anchorType() == Position::PositionIsAfterAnchor || !offsetIsBeforeLastNodeOffset(s.offsetInContainerNode(), s.containerNode()) in WebCore::ApplyStyleCommand::removeInlineStyle 2016-08-03 13:48:22 -0700 1 1 1 Unclassified WebKit HTML Editing 528+ (Nightly build) Unspecified Unspecified RESOLVED WORKSFORME P2 Normal --- 116980 1 rhodovan.u-szeged webkit-unassigned bfulgham enrica koivisto rniwa oldest_to_newest 970220 0 221734 rhodovan.u-szeged 2014-01-21 05:02:31 -0800 Created attachment 221734 Test case The failing test: <div>foo <table> <iframe onload="document.designMode='on'; document.execCommand('selectall'); document.execCommand('italic'); document.body.innerHTML='PASS'; "> </div> Note that several dump messages are generated before we actually reach the crash. The backtrace: ASSERTION FAILED: s.anchorType() == Position::PositionIsAfterAnchor || !offsetIsBeforeLastNodeOffset(s.offsetInContainerNode(), s.containerNode()) /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/ApplyStyleCommand.cpp(1154) : void WebCore::ApplyStyleCommand::removeInlineStyle(WebCore::EditingStyle*, const WebCore::Position&, const WebCore::Position&) 1 0x7ffff5c172a1 WTFCrash 2 0x7ffff0a6f6fd WebCore::ApplyStyleCommand::removeInlineStyle(WebCore::EditingStyle*, WebCore::Position const&, WebCore::Position const&) 3 0x7ffff0a6c4ca WebCore::ApplyStyleCommand::applyInlineStyle(WebCore::EditingStyle*) 4 0x7ffff0a69a37 WebCore::ApplyStyleCommand::doApply() 5 0x7ffff0a78c54 WebCore::CompositeEditCommand::apply() 6 0x7ffff0a78a4c WebCore::applyCommand(WTF::PassRefPtr<WebCore::CompositeEditCommand>) 7 0x7ffff0a9c3ea WebCore::Editor::applyStyle(WebCore::StyleProperties*, WebCore::EditAction) 8 0x7ffff0aaccd0 9 0x7ffff0aad2df 10 0x7ffff0ab0ad6 11 0x7ffff0ab1f22 WebCore::Editor::Command::execute(WTF::String const&, WebCore::Event*) const 12 0x7ffff0976ab2 WebCore::Document::execCommand(WTF::String const&, bool, WTF::String const&) 13 0x7ffff1812910 WebCore::jsDocumentPrototypeFunctionExecCommand(JSC::ExecState*) 14 0x7fff9d5640e5 Program received signal SIGSEGV, Segmentation fault. 0x00007ffff5c172a6 in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:333 333 *(int *)(uintptr_t)0xbbadbeef = 0; (gdb) bt #0 0x00007ffff5c172a6 in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:333 #1 0x00007ffff0a6f6fd in WebCore::ApplyStyleCommand::removeInlineStyle (this=0x32c6f20, style=0x32ca0e0, start=..., end=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/ApplyStyleCommand.cpp:1154 #2 0x00007ffff0a6c4ca in WebCore::ApplyStyleCommand::applyInlineStyle (this=0x32c6f20, style=0x32ca0e0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/ApplyStyleCommand.cpp:637 #3 0x00007ffff0a69a37 in WebCore::ApplyStyleCommand::doApply (this=0x32c6f20) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/ApplyStyleCommand.cpp:220 #4 0x00007ffff0a78c54 in WebCore::CompositeEditCommand::apply (this=0x32c6f20) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/CompositeEditCommand.cpp:227 #5 0x00007ffff0a78a4c in WebCore::applyCommand (command=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/CompositeEditCommand.cpp:182 #6 0x00007ffff0a9c3ea in WebCore::Editor::applyStyle (this=0x8de210, style=0x32bb750, editingAction=WebCore::EditActionUnspecified) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/Editor.cpp:982 #7 0x00007ffff0aaccd0 in WebCore::applyCommandToFrame (frame=..., source=WebCore::CommandFromDOM, action=WebCore::EditActionItalics, style=0x32bb750) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/EditorCommand.cpp:110 #8 0x00007ffff0aad2df in WebCore::executeToggleStyle (frame=..., source=WebCore::CommandFromDOM, action=WebCore::EditActionItalics, propertyID=WebCore::CSSPropertyFontStyle, offValue=0x7ffff208a14c "normal", onValue=0x7ffff208a153 "italic") at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/EditorCommand.cpp:171 #9 0x00007ffff0ab0ad6 in WebCore::executeToggleItalic (frame=..., source=WebCore::CommandFromDOM) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/EditorCommand.cpp:1119 #10 0x00007ffff0ab1f22 in WebCore::Editor::Command::execute (this=0x7fffff823d90, parameter=..., triggeringEvent=0x0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/EditorCommand.cpp:1740 #11 0x00007ffff0976ab2 in WebCore::Document::execCommand (this=0x11c7e40, commandName=..., userInterface=false, value=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Document.cpp:4220 #12 0x00007ffff1812910 in WebCore::jsDocumentPrototypeFunctionExecCommand (exec=0x7fff93d6c680) at /home/reni/Data/REPOS/webkit_sec/WebKitBuild/Debug/DerivedSources/WebCore/JSDocument.cpp:3369 #13 0x00007fff9d5640e5 in ?? () #14 0x00007fff93d6c6d0 in ?? () #15 0x00007fffdd563a65 in ?? () #16 0x00007fffdd5638a0 in ?? () #17 0x0000000001141730 in ?? () #18 0x0000000000000001 in ?? () #19 0x0000000000000001 in ?? () #20 0x0000000001109320 in ?? () #21 0x0000000000000000 in ?? () 1217138 1 bfulgham 2016-08-03 13:48:22 -0700 This issue no longer occurs under GuardMalloc or ASAN as of r204037. If you believe there is still a bug, please reopen this issue with a revised test case. 221734 2014-01-21 05:02:31 -0800 2014-01-21 05:02:31 -0800 Test case lastCrash.html text/html 239 rhodovan.u-szeged PGRpdj5mb28KCTx0YWJsZT4KCQk8aWZyYW1lIG9ubG9hZD0iZG9jdW1lbnQuZGVzaWduTW9kZT0m YXBvcztvbiZhcG9zOzsKCQkJCQkJZG9jdW1lbnQuZXhlY0NvbW1hbmQoJmFwb3M7c2VsZWN0YWxs JmFwb3M7KTsgICAgIAoJCQkJCQlkb2N1bWVudC5leGVjQ29tbWFuZCgmYXBvcztpdGFsaWMmYXBv czspOwoJCQkJCQlkb2N1bWVudC5ib2R5LmlubmVySFRNTD0mYXBvcztQQVNTJmFwb3M7OwoJCQkJ CQkiPgo8L2Rpdj4=