135604 2014-08-05 03:55:25 -0700 ASSERTION FAILED: canHaveChildrenForEditing(parent.get()) in WebCore::CompositeEditCommand::appendNode 2016-08-04 10:04:07 -0700 1 1 1 Unclassified WebKit New Bugs 528+ (Nightly build) Unspecified Unspecified NEW InRadar P2 Normal --- 116980 1 mhodovan.u-szeged webkit-unassigned bfulgham darin rhodovan.u-szeged rniwa sullivan tony webkit-bug-importer oldest_to_newest 1026830 0 mhodovan.u-szeged 2014-08-05 03:55:25 -0700 Test: <html> <head> <script> function f() { document.designMode = 'on'; document.execCommand("selectAll", false, null); document.execCommand("indent" , false , null); } </script> </head> <body onload='f()'> <object>1</object> </body> </html> 1026841 1 mhodovan.u-szeged 2014-08-05 07:18:32 -0700 Backtrace: #0 0x00007ffff57c170b in WTFCrash () at WebKit/Source/WTF/wtf/Assertions.cpp:329 #1 0x00007ffff0b4d710 in WebCore::CompositeEditCommand::appendNode (this=0x835d00, node=..., parent=...) at WebKit/Source/WebCore/editing/CompositeEditCommand.cpp:399 #2 0x00007ffff0b51490 in WebCore::CompositeEditCommand::cloneParagraphUnderNewElement (this=0x835d00, start=..., end=..., passedOuterNode=0x819f60, blockElement=0x83a250) at WebKit/Source/WebCore/editing/CompositeEditCommand.cpp:1081 #3 0x00007ffff0b51d3b in WebCore::CompositeEditCommand::moveParagraphWithClones (this=0x835d00, startOfParagraphToMove=..., endOfParagraphToMove=..., blockElement=0x83a250, outerNode=0x819f60) at WebKit/Source/WebCore/editing/CompositeEditCommand.cpp:1177 #4 0x00007ffff0b991b7 in WebCore::IndentOutdentCommand::indentIntoBlockquote (this=0x835d00, start=..., end=..., targetBlockquote=...) at WebKit/Source/WebCore/editing/IndentOutdentCommand.cpp:118 #5 0x00007ffff0b9a2b6 in WebCore::IndentOutdentCommand::formatRange (this=0x835d00, start=..., end=..., blockquoteForNextIndent=...) at WebKit/Source/WebCore/editing/IndentOutdentCommand.cpp:237 #6 0x00007ffff0b3ad77 in WebCore::ApplyBlockElementCommand::formatSelection (this=0x835d00, startOfSelection=..., endOfSelection=...) at WebKit/Source/WebCore/editing/ApplyBlockElementCommand.cpp:141 #7 0x00007ffff0b9a239 in WebCore::IndentOutdentCommand::formatSelection (this=0x835d00, startOfSelection=..., endOfSelection=...) at WebKit/Source/WebCore/editing/IndentOutdentCommand.cpp:227 #8 0x00007ffff0b3a298 in WebCore::ApplyBlockElementCommand::doApply (this=0x835d00) at WebKit/Source/WebCore/editing/ApplyBlockElementCommand.cpp:86 #9 0x00007ffff0b4c848 in WebCore::CompositeEditCommand::apply (this=0x835d00) at WebKit/Source/WebCore/editing/CompositeEditCommand.cpp:227 #10 0x00007ffff0b4c637 in WebCore::applyCommand (command=...) at WebKit/Source/WebCore/editing/CompositeEditCommand.cpp:182 #11 0x00007ffff0b85af4 in WebCore::executeIndent (frame=...) at WebKit/Source/WebCore/editing/EditorCommand.cpp:489 #12 0x00007ffff0b89107 in WebCore::Editor::Command::execute (this=0x7fffffffc800, parameter=..., triggeringEvent=0x0) at WebKit/Source/WebCore/editing/EditorCommand.cpp:1740 #13 0x00007ffff0a400a4 in WebCore::Document::execCommand (this=0x766900, commandName=..., userInterface=false, value=...) at WebKit/Source/WebCore/dom/Document.cpp:4279 #14 0x00007ffff195fc60 in WebCore::jsDocumentPrototypeFunctionExecCommand (exec=0x7fffffffc8f0) at WebKit/WebKitBuild/Debug/DerivedSources/WebCore/JSDocument.cpp:4526 #15 0x00007fff9cee00b4 in ?? () #16 0x00007fffffffc950 in ?? () #17 0x00007ffff57aab2c in llint_entry () from WebKit/WebKitBuild/Debug/lib/libjavascriptcore_efl.so.0 1173690 2 273718 rhodovan.u-szeged 2016-03-11 03:27:24 -0800 Created attachment 273718 Test It's still valid on ToT WebKit. Validated on r197952 both with Mac and EFL builds. 1217227 3 bfulgham 2016-08-03 14:53:05 -0700 This reproduces in r204037. 1217443 4 webkit-bug-importer 2016-08-04 10:04:07 -0700 <rdar://problem/27701780> 273718 2016-03-11 03:27:24 -0800 2016-03-11 03:27:24 -0800 Test test.html text/html 350 rhodovan.u-szeged PGh0bWw+CiAgICA8aGVhZD4KICAgICAgICA8c2NyaXB0PgogICAgICAgICAgICBmdW5jdGlvbiBm KCkgewogICAgICAgICAgICAgICAgZG9jdW1lbnQuZGVzaWduTW9kZSA9ICdvbic7CiAgICAgICAg ICAgICAgICBkb2N1bWVudC5leGVjQ29tbWFuZCgic2VsZWN0QWxsIiwgZmFsc2UsIG51bGwpOyAg ICAKICAgICAgICAgICAgICAgIGRvY3VtZW50LmV4ZWNDb21tYW5kKCJpbmRlbnQiICwgZmFsc2Ug LCBudWxsKTsKICAgICAgICAgICAgfQogICAgICAgIDwvc2NyaXB0PgogICAgPC9oZWFkPgogICAg PGJvZHkgb25sb2FkPSdmKCknPgogICAgICAgIDxvYmplY3Q+MTwvb2JqZWN0PgogICA8L2JvZHk+ CjwvaHRtbD4=