19075 2008-05-15 04:20:11 -0700 ASSERT in editing code, ASSERTION FAILED: selection.isCaretOrRange() 2008-06-10 19:23:31 -0700 1 1 1 Unclassified WebKit HTML Editing 528+ (Nightly build) Mac OS X 10.5 RESOLVED WORKSFORME P2 Normal --- 18858 1 eric webkit-unassigned justin.garcia oldest_to_newest 80485 0 eric 2008-05-15 04:20:11 -0700 ASSERT in editing code, ASSERTION FAILED: selection.isCaretOrRange() ASSERTION FAILED: selection.isCaretOrRange() (/Users/eseidel/Projects/WebKit/WebCore/editing/ReplaceSelectionCommand.cpp:594 virtual void WebCore::ReplaceSelectionCommand::doApply()) The commands: doc.execCommand('createLink', 0, '</td>'); doc.execCommand('justifyright', 1, '<script src=https://webkit.org>'); doc.execCommand('cut', 0, 'javascript:1'); doc.execCommand('insertunorderedlist', 1, 'courier'); doc.execCommand('insertunorderedlist', 1, 'courier'); doc.execCommand('insertunorderedlist', 0, ''); doc.execCommand('createLink', 0, '<tr>'); doc.execCommand('insertunorderedlist', 1, '<table>'); doc.execCommand('paste', 1, 'red'); doc.execCommand('insertorderedlist', 1, ''); doc.execCommand('insertparagraph', 0, 'javascript:1'); doc.execCommand('justifycenter', 0, 'https://www.webkit.org'); doc.execCommand('createLink', 1, '<iframe src=about:blank>'); doc.execCommand('indent', 0, 'red'); doc.execCommand('outdent', 0, '</tr>'); Unfortunately my reduction script reduced it far enough that it no longer crashes in Safari, but it does crash in DRT. You'll have to run this test under DRT to see the crash. 80486 1 eric 2008-05-15 04:20:48 -0700 The value parameters for most of those calls can probably be removed. 80487 2 21159 eric 2008-05-15 04:24:11 -0700 Created attachment 21159 test case (ONLY ASSERTS under DRT in Debug mode) 82882 3 eric 2008-06-10 19:23:31 -0700 I still hit this ASSERT with the fuzzer, but not with this test case. I guess I'll close and open a new bug with a new test case. 21159 2008-05-15 04:24:11 -0700 2008-05-15 04:24:11 -0700 test case (ONLY ASSERTS under DRT in Debug mode) reduce-test.html text/html 955 eric PGlmcmFtZSBpZD1mIG5hbWU9ZiBzcmM9ImFib3V0OmJsYW5rIiB3aWR0aD0xMDAlIGhlaWdodD01 MCU+PC9pZnJhbWU+CjxzY3JpcHQ+CnZhciBpZnJhbWUgPSBkb2N1bWVudC5nZXRFbGVtZW50QnlJ ZCgiZiIpOwpkb2MgPSBpZnJhbWUuY29udGVudERvY3VtZW50Owpkb2MuYWRkRXZlbnRMaXN0ZW5l cigiY2xpY2siLCBnb3RGb2N1cywgdHJ1ZSk7CmRvYy5kZXNpZ25Nb2RlID0gJ29uJzsKZnVuY3Rp b24gZ290Rm9jdXMoKSB7CiAgZG9jLmV4ZWNDb21tYW5kKCdjcmVhdGVMaW5rJywgMCwgJzwvdGQ+ Jyk7CiAgZG9jLmV4ZWNDb21tYW5kKCdqdXN0aWZ5cmlnaHQnKTsKICBkb2MuZXhlY0NvbW1hbmQo J2N1dCcpOwogIGRvYy5leGVjQ29tbWFuZCgnaW5zZXJ0dW5vcmRlcmVkbGlzdCcpOwogIGRvYy5l eGVjQ29tbWFuZCgnaW5zZXJ0dW5vcmRlcmVkbGlzdCcpOwogIGRvYy5leGVjQ29tbWFuZCgnaW5z ZXJ0dW5vcmRlcmVkbGlzdCcpOwogIGRvYy5leGVjQ29tbWFuZCgnY3JlYXRlTGluaycsIDAsICc8 dHI+Jyk7CiAgZG9jLmV4ZWNDb21tYW5kKCdpbnNlcnR1bm9yZGVyZWRsaXN0Jyk7CiAgZG9jLmV4 ZWNDb21tYW5kKCdwYXN0ZScpOwogIGRvYy5leGVjQ29tbWFuZCgnaW5zZXJ0b3JkZXJlZGxpc3Qn KTsKICBkb2MuZXhlY0NvbW1hbmQoJ2luc2VydHBhcmFncmFwaCcpOwogIGRvYy5leGVjQ29tbWFu ZCgnanVzdGlmeWNlbnRlcicpOwogIGRvYy5leGVjQ29tbWFuZCgnY3JlYXRlTGluaycsIDEsICc8 aWZyYW1lIHNyYz1hYm91dDpibGFuaz4nKTsKICBkb2MuZXhlY0NvbW1hbmQoJ2luZGVudCcpOwog IGRvYy5leGVjQ29tbWFuZCgnb3V0ZGVudCcpOwp9CmlmICh3aW5kb3cuZXZlbnRTZW5kZXIpIHsK ICBldmVudFNlbmRlci5tb3VzZU1vdmVUbygxMDAsIDEwMCk7CiAgZXZlbnRTZW5kZXIubW91c2VE b3duKCk7CiAgZXZlbnRTZW5kZXIubW91c2VVcCgpOwp9Cjwvc2NyaXB0Pg==