151488 2015-11-20 03:09:58 -0800 ASSERTION FAILED: m_offset <= m_node->length() in DeleteFromTextNodeCommand::DeleteFromTextNodeCommand 2023-02-22 15:51:21 -0800 1 1 1 Unclassified WebKit HTML Editing WebKit Local Build Unspecified Unspecified RESOLVED CONFIGURATION CHANGED P2 Normal --- 151442 1 cgarcia webkit-unassigned ahmad.saleem792 rniwa oldest_to_newest 1143616 0 cgarcia 2015-11-20 03:09:58 -0800 This was revealed by new test added in bug #151442, but it's a different issue, since it can be reproduced without the patch. There's a bug in chromium as well that contains a test case to reproduce it, see https://code.google.com/p/chromium/issues/detail?id=504932 1935992 1 ahmad.saleem792 2023-02-22 15:21:22 -0800 I took the test case from Chromium bug and changed it to JSFiddle and it does not crash WebKit Debug build based of 260689@main on WK2 minibrowser window. Do we need to track it? 1935999 2 rniwa 2023-02-22 15:51:21 -0800 Sounds like config changed to me.