218276 2020-10-28 03:02:45 -0700 REGRESSION(r267329): Crash in VisibleSelection::toNormalizedRange() 2020-10-28 20:53:09 -0700 1 1 1 Unclassified WebKit HTML Editing WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 216739 1 rniwa rniwa darin ews-watchlist mifenton sam wenson_hsieh oldest_to_newest 1702258 0 rniwa 2020-10-28 03:02:45 -0700 e.g. #0 0x74dbc0571 in WebCore::Node::treeScope() const+0x21 (/Volumes/Data/safari-2/OpenSource/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1be571) #1 0x74dba3078 in WebCore::Node::document() const+0x8 (/Volumes/Data/safari-2/OpenSource/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1a1078) #2 0x751459529 in WebCore::VisibleSelection::toNormalizedRange() const+0xe9 (/Volumes/Data/safari-2/OpenSource/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x3a57529) #3 0x7513807b2 in WebCore::Editor::shouldChangeSelection(WebCore::VisibleSelection const&, WebCore::VisibleSelection const&, WebCore::Affinity, bool) const+0x112 (/Volumes/Data/safari-2/OpenSource/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x397e7b2) #4 0x75137a33a in WebCore::FrameSelection::shouldChangeSelection(WebCore::VisibleSelection const&) const+0x4a (/Volumes/Data/safari-2/OpenSource/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x397833a) #5 0x7513683f8 in WebCore::Editor::changeSelectionAfterCommand(WebCore::VisibleSelection const&, WTF::OptionSet<WebCore::FrameSelection::SetSelectionOption>)+0x1c8 (/Volumes/Data/safari-2/OpenSource/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x39663f8) #6 0x75136785b in WebCore::Editor::appliedEditing(WebCore::CompositeEditCommand&)+0x25b (/Volumes/Data/safari-2/OpenSource/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x396585b) #7 0x75142d04d in WebCore::TypingCommand::typingAddedToOpenCommand(WebCore::TypingCommand::ETypingCommand)+0x11d (/Volumes/Data/safari-2/OpenSource/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x3a2b04d) #8 0x7514287af in WebCore::TypingCommand::deleteKeyPressed(WebCore::TextGranularity, bool)+0x107f (/Volumes/Data/safari-2/OpenSource/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x3a267af) #9 0x75142bffe in WebCore::TypingCommand::doApply()+0x1be (/Volumes/Data/safari-2/OpenSource/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x3a29ffe) #10 0x7512eb666 in WebCore::CompositeEditCommand::apply()+0x216 (/Volumes/Data/safari-2/OpenSource/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x38e9666) #11 0x75142748b in WebCore::TypingCommand::deleteKeyPressed(WebCore::Document&, unsigned int, WebCore::TextGranularity)+0x29b (/Volumes/Data/safari-2/OpenSource/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x3a2548b) #12 0x7513a974e in WebCore::executeDelete(WebCore::Frame&, WebCore::Event*, WebCore::EditorCommandSource, WTF::String const&)+0xde (/Volumes/Data/safari-2/OpenSource/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x39a774e) #13 0x75136febb in WebCore::Editor::Command::execute(WTF::String const&, WebCore::Event*) const+0xdb (/Volumes/Data/safari-2/OpenSource/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x396debb) #14 0x750ff39e3 in WebCore::Document::execCommand(WTF::String const&, bool, WTF::String const&)+0xf3 (/Volumes/Data/safari-2/OpenSource/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x35f19e3) #15 0x74e548d29 in WebCore::jsDocumentPrototypeFunctionExecCommandBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSDocument*)+0x469 (/Volumes/Data/safari-2/OpenSource/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xb46d29) #16 0x74e3f17db in long long WebCore::IDLOperation<WebCore::JSDocument>::call<&(WebCore::jsDocumentPrototypeFunctionExecCommandBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSDocument*)), (WebCore::CastedThisErrorBehavior)0>(JSC::JSGlobalObject&, JSC::CallFrame&, char const*)+0xfb (/Volumes/Data/safari-2/OpenSource/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x9ef7db) #17 0x74e3f16d8 in WebCore::jsDocumentPrototypeFunctionExecCommand(JSC::JSGlobalObject*, JSC::CallFrame*)+0x8 (/Volumes/Data/safari-2/OpenSource/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x9ef6d8) <rdar://problem/70064038> 1702259 1 412516 rniwa 2020-10-28 03:13:35 -0700 Created attachment 412516 Fixes the bug 1702621 2 ews-feeder 2020-10-28 20:53:08 -0700 Committed r269136: <https://trac.webkit.org/changeset/269136> All reviewed patches have been landed. Closing bug and clearing flags on attachment 412516. 412516 2020-10-28 03:13:35 -0700 2020-10-28 20:53:09 -0700 Fixes the bug bug-218276-20201028031334.patch text/plain 4935 rniwa U3VidmVyc2lvbiBSZXZpc2lvbjogMjY5MDk1CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggNzQ1MWEyOGI0NWEwYmRj MmQzZjAwMDEzMTY2ZTBmZmM3YTQ4OTRlMy4uMTU2NTM5ZWQ1OWYwOTM4MzliN2FlZDgzY2EyYTQ4 NjlmMTA2NjZjMiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIwIEBACisyMDIwLTEwLTI4ICBSeW9z dWtlIE5pd2EgIDxybml3YUB3ZWJraXQub3JnPgorCisgICAgICAgIFJFR1JFU1NJT04ocjI2NzMy OSk6IENyYXNoIGluIFZpc2libGVTZWxlY3Rpb246OnRvTm9ybWFsaXplZFJhbmdlKCkKKyAgICAg ICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIxODI3NgorCisgICAg ICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFRoZSBjcmFzaCB3YXMg YSBzeW1wdG9tIG9mIHRoZSBpc3N1ZSB0aGF0IG1fZXh0ZW50IG9yIG1fYmFzZSBjb3VsZCBiZSBu dWxsIGJ1dCBub3QgdGhlIG90aGVyCisgICAgICAgIHdoZW4gY2Fub25pY2FsaXppbmcgYSBub24t bnVsbCBQb3NpdGlvbiB3aXRoIFZpc2libGVQb3NpdGlvbiB3aWxsIG1ha2UgaXQgbnVsbC4KKwor ICAgICAgICBGaXhlZCB0aGUgYnVnIGJ5IG1ha2luZyBzdXJlIGJhc2UgYW5kIGV4dGVudCdzIG51 bGxuZXNzIG1hdGNoLgorCisgICAgICAgIFRlc3Q6IGVkaXRpbmcvc2VsZWN0aW9uL2RlbGV0ZS1z ZWxlY3Rpb24td2l0aC1kaXNjb25uZWN0ZWQtZXh0ZW50Lmh0bWwKKworICAgICAgICAqIGVkaXRp bmcvVmlzaWJsZVNlbGVjdGlvbi5jcHA6CisgICAgICAgIChXZWJDb3JlOjpWaXNpYmxlU2VsZWN0 aW9uOjpzZXRCYXNlQW5kRXh0ZW50VG9EZWVwRXF1aXZhbGVudHMpOgorCiAyMDIwLTEwLTI3ICBX ZW5zb24gSHNpZWggIDx3ZW5zb25faHNpZWhAYXBwbGUuY29tPgogCiAgICAgICAgIFtDb25jdXJy ZW50IGRpc3BsYXkgbGlzdHNdIEFkZCBhbHRlcm5hdGUgdmVyc2lvbnMgb2YgZXhpc3RpbmcgZGlz cGxheSBsaXN0IGl0ZW1zIHRoYXQgb25seSBjb250YWluIGlubGluZSBkYXRhCmRpZmYgLS1naXQg YS9Tb3VyY2UvV2ViQ29yZS9lZGl0aW5nL1Zpc2libGVTZWxlY3Rpb24uY3BwIGIvU291cmNlL1dl YkNvcmUvZWRpdGluZy9WaXNpYmxlU2VsZWN0aW9uLmNwcAppbmRleCBhYTU0NjQxNGU0MGVmZDgy YzdhZTIyZTg0ZmExNGMzYmU0ODU1OTI5Li5iYWQ1MzU3M2JhOWQ3OWRlZDlkMWI1MmYwNmIxZWI4 M2Q1YzA4ZTg5IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9lZGl0aW5nL1Zpc2libGVTZWxl Y3Rpb24uY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL2VkaXRpbmcvVmlzaWJsZVNlbGVjdGlvbi5j cHAKQEAgLTIzMiw2ICsyMzIsMTIgQEAgdm9pZCBWaXNpYmxlU2VsZWN0aW9uOjpzZXRCYXNlQW5k RXh0ZW50VG9EZWVwRXF1aXZhbGVudHMoKQogICAgICAgICBtX2V4dGVudCA9IG1fYmFzZTsKICAg ICBlbHNlCiAgICAgICAgIG1fZXh0ZW50ID0gVmlzaWJsZVBvc2l0aW9uKG1fZm9jdXMsIG1fYWZm aW5pdHkpLmRlZXBFcXVpdmFsZW50KCk7CisgICAgaWYgKG1fYmFzZS5pc051bGwoKSAhPSBtX2V4 dGVudC5pc051bGwoKSkgeworICAgICAgICBpZiAobV9iYXNlLmlzTnVsbCgpKQorICAgICAgICAg ICAgbV9iYXNlID0gbV9leHRlbnQ7CisgICAgICAgIGVsc2UKKyAgICAgICAgICAgIG1fZXh0ZW50 ID0gbV9iYXNlOworICAgIH0KIH0KIAogdm9pZCBWaXNpYmxlU2VsZWN0aW9uOjphZGp1c3RTZWxl Y3Rpb25SZXNwZWN0aW5nR3JhbnVsYXJpdHkoVGV4dEdyYW51bGFyaXR5IGdyYW51bGFyaXR5KQpk aWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9n CmluZGV4IGEwMTQ4NmY5ZjZkYmQwZGI1MDAwOWFmYjk2NDE0YzQ4ZDBkNWY2MmIuLjNiM2JlM2Y1 OTMzZDEwNzM3ZWYzMGRjYWJiMDdhMjkxMDlkZTllMmYgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3Rz L0NoYW5nZUxvZworKysgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxNiBAQAor MjAyMC0xMC0yOCAgUnlvc3VrZSBOaXdhICA8cm5pd2FAd2Via2l0Lm9yZz4KKworICAgICAgICBS RUdSRVNTSU9OKHIyNjczMjkpOiBDcmFzaCBpbiBWaXNpYmxlU2VsZWN0aW9uOjp0b05vcm1hbGl6 ZWRSYW5nZSgpCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9p ZD0yMTgyNzYKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAg ICBBZGRlZCBhIHJlZ3Jlc3Npb24gdGVzdCBhbmQgcmViYXNlbGluZWQgdGhlIHRlc3Qgbm93IHRo YXQgd2UgZ290IHRoZSBwcmUtcjI2NzMyOSBiZWhhdmlvciBiYWNrLgorCisgICAgICAgICogZWRp dGluZy9leGVjQ29tbWFuZC9pbnNlcnQtbGlzdC1uZXN0ZWQtd2l0aC1vcnBoYW5lZC1leHBlY3Rl ZC50eHQ6IFJldmVydGVkIHRoZSByZWJhc2VsaW5lIGluIHIyNjczMjkuCisgICAgICAgICogZWRp dGluZy9zZWxlY3Rpb24vZGVsZXRlLXNlbGVjdGlvbi13aXRoLWRpc2Nvbm5lY3RlZC1leHRlbnQt ZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiBlZGl0aW5nL3NlbGVjdGlvbi9kZWxldGUt c2VsZWN0aW9uLXdpdGgtZGlzY29ubmVjdGVkLWV4dGVudC5odG1sOiBBZGRlZC4KKwogMjAyMC0x MC0yNyAgWmFsYW4gQnVqdGFzICA8emFsYW5AYXBwbGUuY29tPgogCiAgICAgICAgIFJlbW92ZSB1 bm5lZWRlZCB3aGl0ZXNwYWNlIGJldHdlZW4gY29udGVudCBhbmQgPGJyPgpkaWZmIC0tZ2l0IGEv TGF5b3V0VGVzdHMvZWRpdGluZy9leGVjQ29tbWFuZC9pbnNlcnQtbGlzdC1uZXN0ZWQtd2l0aC1v cnBoYW5lZC1leHBlY3RlZC50eHQgYi9MYXlvdXRUZXN0cy9lZGl0aW5nL2V4ZWNDb21tYW5kL2lu c2VydC1saXN0LW5lc3RlZC13aXRoLW9ycGhhbmVkLWV4cGVjdGVkLnR4dAppbmRleCBkMTY0Nzgz MTY4MTQ2YWMwMjk2ODZkYTEzNWNkMTA3ZmU3YjYzMjZiLi40MDNmZTUyNjU1OTk0Y2ZhMzJkYjJm NWEyODViNjhhNTdhYjFlNzRjIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9lZGl0aW5nL2V4ZWND b21tYW5kL2luc2VydC1saXN0LW5lc3RlZC13aXRoLW9ycGhhbmVkLWV4cGVjdGVkLnR4dAorKysg Yi9MYXlvdXRUZXN0cy9lZGl0aW5nL2V4ZWNDb21tYW5kL2luc2VydC1saXN0LW5lc3RlZC13aXRo LW9ycGhhbmVkLWV4cGVjdGVkLnR4dApAQCAtMTcsNyArMTcsNyBAQCBUaGlzIHRlc3RzIGhhbmcg d2hlbiBsaXN0aWZ5aW5nIG5lc3RlZCBsaXN0cyB3aXRoIGFuIG9ycGhhbmVkIGxpc3QgY2hpbGQg aW4gYmV0dwogICAgICAgICAiCiB8ICAgICA8b2w+CiB8ICAgICAgIDxsaT4KLXwgICAgICAgICAi YmVjYXVzZSBvZiB5b3UiCit8ICAgICAgICAgIjwjc2VsZWN0aW9uLWNhcmV0PmJlY2F1c2Ugb2Yg eW91IgogfCAgICIKICAgICAiCiB8ICIKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2VkaXRpbmcv c2VsZWN0aW9uL2RlbGV0ZS1zZWxlY3Rpb24td2l0aC1kaXNjb25uZWN0ZWQtZXh0ZW50LWV4cGVj dGVkLnR4dCBiL0xheW91dFRlc3RzL2VkaXRpbmcvc2VsZWN0aW9uL2RlbGV0ZS1zZWxlY3Rpb24t d2l0aC1kaXNjb25uZWN0ZWQtZXh0ZW50LWV4cGVjdGVkLnR4dApuZXcgZmlsZSBtb2RlIDEwMDY0 NAppbmRleCAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwLi5mZWQxNjk0 ZjQ2ZjU0ZTgwMTBjOTE5OWIyZDc5ZmY2N2IyNzZjMTQwCi0tLSAvZGV2L251bGwKKysrIGIvTGF5 b3V0VGVzdHMvZWRpdGluZy9zZWxlY3Rpb24vZGVsZXRlLXNlbGVjdGlvbi13aXRoLWRpc2Nvbm5l Y3RlZC1leHRlbnQtZXhwZWN0ZWQudHh0CkBAIC0wLDAgKzEsMyBAQAorVGhpcyB0ZXN0cyBpbnZv a2luZyBkZWxldGlvbiBhZnRlciBhdHRlbXB0aW5nIHRvIGV4dGVuZCBzZWxlY3Rpb24gdG8gYSBk aXNjb25uZWN0ZWQgbm9kZS4gV2ViS2l0IHNob3VsZCBub3QgY3Jhc2guCisKK1BBU1MuCmRpZmYg LS1naXQgYS9MYXlvdXRUZXN0cy9lZGl0aW5nL3NlbGVjdGlvbi9kZWxldGUtc2VsZWN0aW9uLXdp dGgtZGlzY29ubmVjdGVkLWV4dGVudC5odG1sIGIvTGF5b3V0VGVzdHMvZWRpdGluZy9zZWxlY3Rp b24vZGVsZXRlLXNlbGVjdGlvbi13aXRoLWRpc2Nvbm5lY3RlZC1leHRlbnQuaHRtbApuZXcgZmls ZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwLi5mMDkzMGRhZjQyNzQxY2E5MGMwMmZiY2ExMTVhOTM2ODVhNTVmZGQ1Ci0tLSAvZGV2L251 bGwKKysrIGIvTGF5b3V0VGVzdHMvZWRpdGluZy9zZWxlY3Rpb24vZGVsZXRlLXNlbGVjdGlvbi13 aXRoLWRpc2Nvbm5lY3RlZC1leHRlbnQuaHRtbApAQCAtMCwwICsxLDE1IEBACis8IURPQ1RZUEUg aHRtbD4KKzxzY3JpcHQ+CitmdW5jdGlvbiBydW5UZXN0KCkgeworICAgIGlmICh3aW5kb3cudGVz dFJ1bm5lcikKKyAgICAgICAgdGVzdFJ1bm5lci5kdW1wQXNUZXh0KCk7CisKKyAgICBkb2N1bWVu dC5xdWVyeVNlbGVjdG9yKCdpbnB1dCcpLnNldFJhbmdlVGV4dCgnYWEnLCAwLCAxLCAnZW5kJyk7 CisgICAgZ2V0U2VsZWN0aW9uKCkuZXh0ZW5kKGRvY3VtZW50LmNyZWF0ZUVsZW1lbnQoJ3NlbGVj dCcpKTsKKyAgICBkb2N1bWVudC5leGVjQ29tbWFuZCgnZGVsZXRlJywgZmFsc2UpOworCisgICAg ZG9jdW1lbnQuYm9keS5pbm5lckhUTUwgPSBgPHA+VGhpcyB0ZXN0cyBpbnZva2luZyBkZWxldGlv biBhZnRlciBhdHRlbXB0aW5nIHRvIGV4dGVuZCBzZWxlY3Rpb24gdG8gYSBkaXNjb25uZWN0ZWQg bm9kZS4gV2ViS2l0IHNob3VsZCBub3QgY3Jhc2guPC9wPlBBU1MuYDsKK30KKzwvc2NyaXB0Pgor PGJvZHkgb25sb2FkPXJ1blRlc3QoKT4KKzxpbnB1dD4K