131018 2014-04-01 01:38:36 -0700 ASSERTION FAILED: prev != *this in WebCore::VisiblePosition::previous 2023-01-20 09:45:56 -0800 1 1 1 Unclassified WebKit HTML Editing 528+ (Nightly build) Unspecified Unspecified NEW InRadar P2 Normal --- 116980 1 rhodovan.u-szeged webkit-unassigned ahmad.saleem792 bfulgham darin harrison justin.garcia kling leviw webkit-bug-importer oldest_to_newest 996187 0 228256 rhodovan.u-szeged 2014-04-01 01:38:36 -0700 Created attachment 228256 Test case The failing test: <head> <script> function runTest () { document.execCommand("selectall", true, null); document.execCommand("insertorderedlist", false, null); } </script> </head> <body onload="runTest();" contenteditable="true"> <video> </video> <div> <textarea></textarea> </div> </body>y> </html> The backtrace: ASSERTION FAILED: prev != *this /home/reni2/data/REPOS/webkit_sec/Source/WebCore/editing/VisiblePosition.cpp(89) : WebCore::VisiblePosition WebCore::VisiblePosition::previous(WebCore::EditingBoundaryCrossingRule) const 1 0x7ffff5ed9db5 WTFCrash 2 0x7ffff10e335f WebCore::VisiblePosition::previous(WebCore::EditingBoundaryCrossingRule) const 3 0x7ffff10b1e8c WebCore::InsertListCommand::listifyParagraph(WebCore::VisiblePosition const&, WebCore::QualifiedName const&) 4 0x7ffff10b139c WebCore::InsertListCommand::doApplyForSingleParagraph(bool, WebCore::HTMLQualifiedName const&, WebCore::Range*) 5 0x7ffff10b0a21 WebCore::InsertListCommand::doApply() 6 0x7ffff106123d WebCore::CompositeEditCommand::apply() 7 0x7ffff1061031 WebCore::applyCommand(WTF::PassRefPtr<WebCore::CompositeEditCommand>) 8 0x7ffff109a0cb 9 0x7ffff109d1b4 WebCore::Editor::Command::execute(WTF::String const&, WebCore::Event*) const 10 0x7ffff0f575dc WebCore::Document::execCommand(WTF::String const&, bool, WTF::String const&) 11 0x7ffff1f334f1 WebCore::jsDocumentPrototypeFunctionExecCommand(JSC::ExecState*) 12 0x7fff9b6cb0b4 Program received signal SIGSEGV, Segmentation fault. 0x00007ffff5ed9dba in WTFCrash () at /home/reni2/data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:333 333 *(int *)(uintptr_t)0xbbadbeef = 0; (gdb) bt #0 0x00007ffff5ed9dba in WTFCrash () at /home/reni2/data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:333 #1 0x00007ffff10e335f in WebCore::VisiblePosition::previous (this=0x7fffffffb7b0, rule=WebCore::CannotCrossEditingBoundary) at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/editing/VisiblePosition.cpp:89 #2 0x00007ffff10b1e8c in WebCore::InsertListCommand::listifyParagraph (this=0x1124410, originalStart=..., listTag=...) at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/editing/InsertListCommand.cpp:348 #3 0x00007ffff10b139c in WebCore::InsertListCommand::doApplyForSingleParagraph (this=0x1124410, forceCreateList=false, listTag=..., currentSelection=0x1138530) at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/editing/InsertListCommand.cpp:256 #4 0x00007ffff10b0a21 in WebCore::InsertListCommand::doApply (this=0x1124410) at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/editing/InsertListCommand.cpp:192 #5 0x00007ffff106123d in WebCore::CompositeEditCommand::apply (this=0x1124410) at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/editing/CompositeEditCommand.cpp:227 #6 0x00007ffff1061031 in WebCore::applyCommand (command=...) at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/editing/CompositeEditCommand.cpp:182 #7 0x00007ffff109a0cb in WebCore::executeInsertOrderedList (frame=...) at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/editing/EditorCommand.cpp:551 #8 0x00007ffff109d1b4 in WebCore::Editor::Command::execute (this=0x7fffffffbc50, parameter=..., triggeringEvent=0x0) at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/editing/EditorCommand.cpp:1741 #9 0x00007ffff0f575dc in WebCore::Document::execCommand (this=0x9e8ce0, commandName=..., userInterface=false, value=...) at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/dom/Document.cpp:4217 #10 0x00007ffff1f334f1 in WebCore::jsDocumentPrototypeFunctionExecCommand (exec=0x7fffffffbd50) at /home/reni2/data/REPOS/webkit_sec/WebKitBuild/Debug/DerivedSources/WebCore/JSDocument.cpp:4736 #11 0x00007fff9b6cb0b4 in ?? () #12 0x00007fffffffbdb0 in ?? () #13 0x00007ffff5ec4fb5 in llint_op_call () from /home/reni2/data/REPOS/webkit_sec/WebKitBuild/Debug/lib/libjavascriptcore_efl.so.0 #14 0x0000000000000000 in ?? () 1139922 1 264928 rhodovan.u-szeged 2015-11-06 02:41:31 -0800 Created attachment 264928 Test Replacing the original test case since it doesn't reproduce the issue anymore. 1217176 2 bfulgham 2016-08-03 14:09:33 -0700 This reproduces under r204037. 1217177 3 webkit-bug-importer 2016-08-03 14:09:49 -0700 <rdar://problem/27685432> 1926936 4 ahmad.saleem792 2023-01-20 09:45:56 -0800 This still assert using attached test while using debug build based of WebKit revision 259136@main. 228256 2014-04-01 01:38:36 -0700 2015-11-06 02:41:31 -0800 Test case lastCrash.html text/html 363 rhodovan.u-szeged ICAgPGhlYWQ+CiAgICAgIDxzY3JpcHQ+CiAgICAgICAgIGZ1bmN0aW9uIHJ1blRlc3QgKCkgewog ICAgICAgICAgICBkb2N1bWVudC5leGVjQ29tbWFuZCgic2VsZWN0YWxsIiwgdHJ1ZSwgbnVsbCk7 CiAgICAgICAgICAgIGRvY3VtZW50LmV4ZWNDb21tYW5kKCJpbnNlcnRvcmRlcmVkbGlzdCIsIGZh bHNlLCBudWxsKTsKICAgICAgICAgfQogICAgICA8L3NjcmlwdD4KICAgPC9oZWFkPgogICA8Ym9k eSBvbmxvYWQ9InJ1blRlc3QoKTsiIGNvbnRlbnRlZGl0YWJsZT0idHJ1ZSI+CiAgICAgIDx2aWRl bz4gPC92aWRlbz4KICAgICAgPGRpdj4KICAgICAgICAgPHRleHRhcmVhPjwvdGV4dGFyZWE+CiAg ICAgIDwvZGl2PgogICA8L2JvZHk+ 264928 2015-11-06 02:41:31 -0800 2015-11-06 02:41:31 -0800 Test test.html text/html 229 rhodovan.u-szeged PCFET0NUWVBFIGh0bWw+CjxzdWIgY29udGVudGVkaXRhYmxlPSJmYWxzZSI+PC9zdWI+CjxzcGFu Pjwvc3Bhbj4KPGxpPjwvbGk+CjxzY3JpcHQ+CiAgICBkb2N1bWVudC5kZXNpZ25Nb2RlID0gJ29u JzsKICAgIGRvY3VtZW50LmV4ZWNDb21tYW5kKCJzZWxlY3RBbGwiLCBmYWxzZSwgbnVsbCk7CiAg ICBkb2N1bWVudC5leGVjQ29tbWFuZCgiaW5kZW50IiAsIGZhbHNlICwgbnVsbCk7Cjwvc2NyaXB0 Pg==