48646 2010-10-29 10:36:21 -0700 REGRESSION: Assertion failure in TextCheckingHelper::TextCheckingHelper(), followed by crash 2010-10-29 20:15:28 -0700 1 1 1 Unclassified WebKit HTML Editing 528+ (Nightly build) All All RESOLVED DUPLICATE 48708 Regression P1 Normal --- 1 mitz webkit-unassigned jiapu.mail morrita oldest_to_newest 301859 0 mitz 2010-10-29 10:36:21 -0700 The ASSERT_ARG(m_range, m_range) in the TextCheckingHelper constructor is failing with this backtrace: #0 0x103da002e in WebCore::TextCheckingHelper::TextCheckingHelper at TextCheckingHelper.cpp:42 #1 0x103d9ff1d in WebCore::TextCheckingHelper::TextCheckingHelper at TextCheckingHelper.cpp:40 #2 0x1031935f9 in WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges at Editor.cpp:2190 #3 0x10318e5d4 in WebCore::Editor::correctionPanelTimerFired at Editor.cpp:2424 #4 0x10319d40c in WebCore::Timer<WebCore::Editor>::fired at Timer.h:98 #5 0x103dcd783 in WebCore::ThreadTimers::sharedTimerFiredInternal at ThreadTimers.cpp:112 #6 0x103dcd539 in WebCore::ThreadTimers::sharedTimerFired at ThreadTimers.cpp:90 #7 0x103c35959 in WebCore::timerFired at SharedTimerMac.mm:166 The grammarRange parameter to markAllMisspellingsAndBadGrammarInRanges() is allowed to be 0, but now this method tries to use it to construct a TextCheckingHelper without checking. 301861 1 mitz 2010-10-29 10:37:57 -0700 In release builds, this leads to a crash. 302247 2 mitz 2010-10-29 20:15:28 -0700 *** This bug has been marked as a duplicate of bug 48708 ***