175923 2017-08-23 20:17:07 -0700 [iOS WK2] editing/execCommand/forward-delete-read-write-canvas.html hits a debug assertion in Position::Position 2017-08-26 15:18:05 -0700 1 1 1 Unclassified WebKit HTML Editing WebKit Nightly Build Unspecified Unspecified NEW https://bugs.webkit.org/show_bug.cgi?id=175939 P2 Normal --- 1 wenson_hsieh wenson_hsieh ryanhaddad wenson_hsieh oldest_to_newest 1341950 0 wenson_hsieh 2017-08-23 20:17:07 -0700 Test case: load the following HTML: ``` <code style="color: green">PASS</code> <canvas style="-webkit-user-modify: read-write"><input id="input"></canvas> <script> if (window.testRunner) testRunner.dumpAsText(); input.focus(); input.remove(); document.execCommand("ForwardDelete"); </script> ``` ...and observe an assertion like this: Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.JavaScriptCore 0x0000000109518c27 WTFCrash + 39 (Assertions.cpp:278) 1 com.apple.WebCore 0x0000000112e51747 WebCore::Position::Position(WebCore::Node*, int, WebCore::Position::AnchorType) + 183 (Position.cpp:130) 2 com.apple.WebCore 0x0000000112e51819 WebCore::Position::Position(WebCore::Node*, int, WebCore::Position::AnchorType) + 41 (Position.cpp:133) 3 com.apple.WebCore 0x0000000110cd62bc WebCore::positionInParentBeforeNode(WebCore::Node const*) + 124 (Position.h:266) 4 com.apple.WebCore 0x0000000111570f2e WebCore::updatePositionForNodeRemoval(WebCore::Position&, WebCore::Node&) + 270 (Editing.cpp:960) 5 com.apple.WebCore 0x00000001117f9dba WebCore::FrameSelection::respondToNodeModification(WebCore::Node&, bool, bool, bool, bool) + 170 (FrameSelection.cpp:472) 6 com.apple.WebCore 0x00000001117f9cdd WebCore::FrameSelection::nodeWillBeRemoved(WebCore::Node&) + 349 (FrameSelection.cpp:458) 7 com.apple.WebCore 0x000000011141b3a8 WebCore::Document::nodeWillBeRemoved(WebCore::Node&) + 584 (Document.cpp:4075) 8 com.apple.WebCore 0x000000011103ece8 WebCore::ContainerNode::removeChild(WebCore::Node&) + 456 (ContainerNode.cpp:544) 9 com.apple.WebCore 0x0000000112d2a4ad WebCore::Node::remove() + 109 (Node.cpp:565) 10 com.apple.WebCore 0x000000011215a0cd WebCore::jsElementPrototypeFunctionRemoveBody(JSC::ExecState*, WebCore::JSElement*, JSC::ThrowScope&) + 77 (JSElement.cpp:2641) 11 com.apple.WebCore 0x0000000112152717 long long WebCore::IDLOperation<WebCore::JSElement>::call<&(WebCore::jsElementPrototypeFunctionRemoveBody(JSC::ExecState*, WebCore::JSElement*, JSC::ThrowScope&)), (WebCore::CastedThisErrorBehavior)0>(JSC::ExecState&, char const*) + 615 (JSDOMOperation.h:53) 12 com.apple.WebCore 0x000000011214595c WebCore::jsElementPrototypeFunctionRemove(JSC::ExecState*) + 28 (JSElement.cpp:2647) 13 ??? 0x00005c9ab8001028 0 + 101819581730856 14 com.apple.JavaScriptCore 0x00000001090853d6 llint_entry + 31248 15 com.apple.JavaScriptCore 0x000000010907d7a7 vmEntryToJavaScript + 343 16 com.apple.JavaScriptCore 0x0000000108e4bc21 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 353 (JITCode.cpp:81) 17 com.apple.JavaScriptCore 0x0000000108df8853 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::ExecState*, JSC::JSObject*) + 5283 (Interpreter.cpp:912) 18 com.apple.JavaScriptCore 0x0000000108648368 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) + 472 (Completion.cpp:102) 19 com.apple.JavaScriptCore 0x00000001086484b0 JSC::profiledEvaluate(JSC::ExecState*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) + 80 (Completion.cpp:117) Discovered while writing a test case for https://bugs.webkit.org/show_bug.cgi?id=175914. 1342063 1 wenson_hsieh 2017-08-24 09:33:23 -0700 Retitling and repurposing -- looks like WK2 iOS hits a debug assertion when creating a Position anyways in platform-specific code. This looks related to the assertion seen in the original test case below. 1342670 2 ap 2017-08-26 15:16:48 -0700 *** Bug 175939 has been marked as a duplicate of this bug. *** 1342671 3 ap 2017-08-26 15:18:05 -0700 Ryan skipped the test in https://trac.webkit.org/r221140 ASSERTION FAILED: !((anchorType == PositionIsBeforeChildren || anchorType == PositionIsAfterChildren) && (is<Text>(*m_anchorNode) || editingIgnoresContent(*m_anchorNode)))