Bug 175923
| Summary: | [iOS WK2] editing/execCommand/forward-delete-read-write-canvas.html hits a debug assertion in Position::Position | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Wenson Hsieh <wenson_hsieh> |
| Component: | HTML Editing | Assignee: | Wenson Hsieh <wenson_hsieh> |
| Status: | NEW | ||
| Severity: | Normal | CC: | ryanhaddad, wenson_hsieh |
| Priority: | P2 | ||
| Version: | WebKit Nightly Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| See Also: | https://bugs.webkit.org/show_bug.cgi?id=175939 | ||
Wenson Hsieh
Test case: load the following HTML:
```
<code style="color: green">PASS</code>
<canvas style="-webkit-user-modify: read-write"><input id="input"></canvas>
<script>
if (window.testRunner)
testRunner.dumpAsText();
input.focus();
input.remove();
document.execCommand("ForwardDelete");
</script>
```
...and observe an assertion like this:
Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0 com.apple.JavaScriptCore 0x0000000109518c27 WTFCrash + 39 (Assertions.cpp:278)
1 com.apple.WebCore 0x0000000112e51747 WebCore::Position::Position(WebCore::Node*, int, WebCore::Position::AnchorType) + 183 (Position.cpp:130)
2 com.apple.WebCore 0x0000000112e51819 WebCore::Position::Position(WebCore::Node*, int, WebCore::Position::AnchorType) + 41 (Position.cpp:133)
3 com.apple.WebCore 0x0000000110cd62bc WebCore::positionInParentBeforeNode(WebCore::Node const*) + 124 (Position.h:266)
4 com.apple.WebCore 0x0000000111570f2e WebCore::updatePositionForNodeRemoval(WebCore::Position&, WebCore::Node&) + 270 (Editing.cpp:960)
5 com.apple.WebCore 0x00000001117f9dba WebCore::FrameSelection::respondToNodeModification(WebCore::Node&, bool, bool, bool, bool) + 170 (FrameSelection.cpp:472)
6 com.apple.WebCore 0x00000001117f9cdd WebCore::FrameSelection::nodeWillBeRemoved(WebCore::Node&) + 349 (FrameSelection.cpp:458)
7 com.apple.WebCore 0x000000011141b3a8 WebCore::Document::nodeWillBeRemoved(WebCore::Node&) + 584 (Document.cpp:4075)
8 com.apple.WebCore 0x000000011103ece8 WebCore::ContainerNode::removeChild(WebCore::Node&) + 456 (ContainerNode.cpp:544)
9 com.apple.WebCore 0x0000000112d2a4ad WebCore::Node::remove() + 109 (Node.cpp:565)
10 com.apple.WebCore 0x000000011215a0cd WebCore::jsElementPrototypeFunctionRemoveBody(JSC::ExecState*, WebCore::JSElement*, JSC::ThrowScope&) + 77 (JSElement.cpp:2641)
11 com.apple.WebCore 0x0000000112152717 long long WebCore::IDLOperation<WebCore::JSElement>::call<&(WebCore::jsElementPrototypeFunctionRemoveBody(JSC::ExecState*, WebCore::JSElement*, JSC::ThrowScope&)), (WebCore::CastedThisErrorBehavior)0>(JSC::ExecState&, char const*) + 615 (JSDOMOperation.h:53)
12 com.apple.WebCore 0x000000011214595c WebCore::jsElementPrototypeFunctionRemove(JSC::ExecState*) + 28 (JSElement.cpp:2647)
13 ??? 0x00005c9ab8001028 0 + 101819581730856
14 com.apple.JavaScriptCore 0x00000001090853d6 llint_entry + 31248
15 com.apple.JavaScriptCore 0x000000010907d7a7 vmEntryToJavaScript + 343
16 com.apple.JavaScriptCore 0x0000000108e4bc21 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 353 (JITCode.cpp:81)
17 com.apple.JavaScriptCore 0x0000000108df8853 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::ExecState*, JSC::JSObject*) + 5283 (Interpreter.cpp:912)
18 com.apple.JavaScriptCore 0x0000000108648368 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) + 472 (Completion.cpp:102)
19 com.apple.JavaScriptCore 0x00000001086484b0 JSC::profiledEvaluate(JSC::ExecState*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) + 80 (Completion.cpp:117)
Discovered while writing a test case for https://bugs.webkit.org/show_bug.cgi?id=175914.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Wenson Hsieh
Retitling and repurposing -- looks like WK2 iOS hits a debug assertion when creating a Position anyways in platform-specific code. This looks related to the assertion seen in the original test case below.
Alexey Proskuryakov
*** Bug 175939 has been marked as a duplicate of this bug. ***
Alexey Proskuryakov
Ryan skipped the test in https://trac.webkit.org/r221140
ASSERTION FAILED: !((anchorType == PositionIsBeforeChildren || anchorType == PositionIsAfterChildren) && (is<Text>(*m_anchorNode) || editingIgnoresContent(*m_anchorNode)))