| Summary: | ASSERTION FAILED: startBlock != currentRoot in WebCore::ReplaceSelectionCommand::doApply | ||||||
|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Renata Hodovan <rhodovan.u-szeged> | ||||
| Component: | HTML Editing | Assignee: | Nobody <webkit-unassigned> | ||||
| Status: | NEW --- | ||||||
| Severity: | Normal | CC: | ahmad.saleem792, andersca, bfulgham, justin.garcia, kling, koivisto, noam, webkit-bug-importer | ||||
| Priority: | P2 | Keywords: | InRadar | ||||
| Version: | 528+ (Nightly build) | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Bug Depends on: | |||||||
| Bug Blocks: | 116980 | ||||||
| Attachments: |
|
||||||
I am able to reproduce this assert failed in MiniBrowser WK2 Debug build based of 259136@main. But I get this: ASSERTION FAILED: insertionBlock != currentRoot editing/ReplaceSelectionCommand.cpp(1230) : virtual void WebCore::ReplaceSelectionCommand::doApply() 1 0x137e76d84 WTFCrash 2 0x280832730 WTFCrashWithInfo(int, char const*, char const*, int) 3 0x283e7b3b8 WebCore::ReplaceSelectionCommand::doApply() 4 0x283dac198 WebCore::CompositeEditCommand::apply() 5 0x283e43438 WebCore::executeInsertFragment(WebCore::Frame&, WTF::Ref<WebCore::DocumentFragment, WTF::RawPtrTraits<WebCore::DocumentFragment> >&&) 6 0x283e3d604 WebCore::executeInsertHTML(WebCore::Frame&, WebCore::Event*, WebCore::EditorCommandSource, WTF::String const&) 7 0x283e12a30 WebCore::Editor::Command::execute(WTF::String const&, WebCore::Event*) const 8 0x283a99ef0 WebCore::Document::execCommand(WTF::String const&, bool, WTF::String const&) 9 0x280be2e5c WebCore::jsDocumentPrototypeFunction_execCommandBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSDocument*) 10 0x280be2944 long long WebCore::IDLOperation<WebCore::JSDocument>::call<&(WebCore::jsDocumentPrototypeFunction_execCommandBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSDocument*)), (WebCore::CastedThisErrorBehavior)0>(JSC::JSGlobalObject&, JSC::CallFrame&, char const*) 11 0x280bcda00 WebCore::jsDocumentPrototypeFunction_execCommand(JSC::JSGlobalObject*, JSC::CallFrame*) 12 0x14800c03c (null) 13 0x13859e990 llint_entry 14 0x138578eec vmEntryToJavaScript 15 0x1395d7a5c JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) 16 0x1395d8138 JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) 17 0x139a04878 JSC::call(JSC::JSGlobalObject*, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) 18 0x139a0493c JSC::call(JSC::JSGlobalObject*, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) 19 0x139a04c10 JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) 20 0x28323e6b8 WebCore::JSExecState::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) 21 0x283163f10 WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext&, WebCore::Event&) 22 0x283bc8f44 WebCore::EventTarget::innerInvokeEventListeners(WebCore::Event&, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener, WTF::RawPtrTraits<WebCore::RegisteredEventListener>, WTF::DefaultRefDerefTraits<WebCore::RegisteredEventListener> >, 1ul, WTF::CrashOnOverflow, 2ul, WTF::FastMalloc>, WebCore::EventTarget::EventInvokePhase) 23 0x283bbdf30 WebCore::EventTarget::fireEventListeners(WebCore::Event&, WebCore::EventTarget::EventInvokePhase) 24 0x284a5507c WebCore::DOMWindow::dispatchEvent(WebCore::Event&, WebCore::EventTarget*) |
Created attachment 215901 [details] Test case The failing test: <hr> <canvas> <body onload=" document.designMode='on'; document.execCommand('selectall'); document.execCommand('RemoveFormat'); document.execCommand('inserthtml', false);"> </body> </canvas> The backtrace: Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7fffa6be0700 (LWP 17716)] 0x00007ffff4af0ac1 in WTFCrash () at /home/reni/Data/REPOS/webkitnix/Source/WTF/wtf/Assertions.cpp:342 342 *(int *)(uintptr_t)0xbbadbeef = 0; (gdb) bt #0 0x00007ffff4af0ac1 in WTFCrash () at /home/reni/Data/REPOS/webkitnix/Source/WTF/wtf/Assertions.cpp:342 #1 0x00007ffff3372bee in WebCore::ReplaceSelectionCommand::doApply (this=0x63e920) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/ReplaceSelectionCommand.cpp:1009 #2 0x00007ffff330f8fc in WebCore::CompositeEditCommand::apply (this=0x63e920) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/CompositeEditCommand.cpp:211 #3 0x00007ffff330f6fc in WebCore::applyCommand (command=<incomplete type>) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/CompositeEditCommand.cpp:170 #4 0x00007ffff33446c3 in WebCore::executeInsertFragment (frame=..., fragment=<incomplete type>) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/EditorCommand.cpp:195 #5 0x00007ffff3345da6 in WebCore::executeInsertHTML (frame=..., value=...) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/EditorCommand.cpp:500 #6 0x00007ffff33491af in WebCore::Editor::Command::execute (this=0x7fffffffcef0, parameter=..., triggeringEvent=0x0) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/EditorCommand.cpp:1713 #7 0x00007ffff32106ac in WebCore::Document::execCommand (this=0x81b610, commandName=..., userInterface=false, value=...) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/dom/Document.cpp:4110 #8 0x00007ffff3fab309 in WebCore::jsDocumentPrototypeFunctionExecCommand (exec=0x7fffa37fef48) at /home/reni/Data/REPOS/webkitnix/WebKitBuild/Debug/DerivedSources/WebCore/JSDocument.cpp:2705 #9 0x00007fffaa282105 in ?? () #10 0x00007fffffffd030 in ?? () #11 0x00007ffff4875638 in llint_op_call () from /home/reni/Data/REPOS/webkitnix/WebKitBuild/Debug/lib/libWebKitNix.so.0 #12 0x00007fffaa282940 in ?? () #13 0x0000000000689dd8 in ?? () #14 0x0000000000611920 in ?? () #15 0x00007ffff081b9a0 in thread_context_stack () from /home/reni/Data/REPOS/webkitnix/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0 #16 0x00000000008cc9c0 in ?? () #17 0x00007ffff365f4ae in WebCore::ResourceLoader::didReceiveBuffer (this=0x7fffffffd030, buffer=<incomplete type>, encodedDataLength=0) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/loader/ResourceLoader.cpp:483 #18 0x00007fffffffd080 in ?? () #19 0x00007ffff45f340e in JSC::JITCode::execute (this=0x48ff865601e8c789, stack=0x48e0458d48d4ff41, callFrame=0xc78948da89480000, vm=0x1b9c8458b48e0) at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/jit/JITCode.cpp:46 Backtrace stopped: previous frame inner to this frame (corrupt stack?)