Summary: | Dragging image into Google Presentation crashes Safari | ||||||||
---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Eric Seidel (no email) <eric> | ||||||
Component: | HTML Editing | Assignee: | Nobody <webkit-unassigned> | ||||||
Status: | RESOLVED FIXED | ||||||||
Severity: | Normal | CC: | justin.garcia | ||||||
Priority: | P1 | Keywords: | GoogleBug, HasReduction, InRadar | ||||||
Version: | 528+ (Nightly build) | ||||||||
Hardware: | All | ||||||||
OS: | OS X 10.5 | ||||||||
Attachments: |
|
Description
Eric Seidel (no email)
2008-07-24 10:43:14 PDT
This happens in Debug mode as well, but no ASSERT is ever hit. Somehow ReplaceSelectionCommand::m_firstNodeInserted ends up as a disconnected node (i.e. a node with no parent pointer), calling nextPosition on such a node will crash. Perhaps Justin can help me understand what's going on here. It appears that the document fragment is empty here: } else { if (setSelectionToDragCaret(innerFrame, dragCaret, range, point)) applyCommand(ReplaceSelectionCommand::create(m_document, fragment, true, dragData->canSmartReplace(), chosePlainText)); } ReplaceSelectionCommand maybe doesn't expect an empty fragment? I'm not sure why only the second drag crashes? Maybe because the image is already selected after the first drag? Actually, the fragment isn't empty. It's huge. It looks like the whole document... Something is confused here. Oh, nm, I'm calling "showTreeForThis" which is printing more than just what's under the fragment node, or? I suspect that this crash is an "editing" bug in that it appears to be screwing up in the code to find the insertion point. Unsure yet why it would fail to insert the first time round though :-/ <Rdar://6100249> Ok. Looks like the fragment is correct, it's just a single IMG element. We also seem to be going down the correct path during the replacement. The problem comes at the end of the replacement where: (gdb) p m_firstNodeInserted.get()->parentNode() $6 = (const WebCore::Node *) 0x0 m_firstNodeInserted is correctly the "IMG" node, however it's not actually in the document. Still debugging. Ok, this is where the just-inserted node, is removed from the tree: Google Presentation is doing something in a DOMNodeInserted handler. That something seems to be deleting the current selection. Event dispatch starts under: #39 0x03022345 in dispatchChildInsertionEvents at ContainerNode.cpp:954 #0 0x02f5f0ae in WebCore::TreeShared<WebCore::Node>::setParent at TreeShared.h:85 #1 0x0302435d in WebCore::ContainerNode::removeChild at ContainerNode.cpp:435 #2 0x033f8017 in WebCore::RemoveNodeCommand::doApply at RemoveNodeCommand.cpp:49 #3 0x03143c63 in WebCore::EditCommand::apply at EditCommand.cpp:101 #4 0x030180e3 in WebCore::CompositeEditCommand::applyCommandToComposite at CompositeEditCommand.cpp:97 #5 0x030189fd in WebCore::CompositeEditCommand::removeNode at CompositeEditCommand.cpp:194 #6 0x030fc9ff in WebCore::DeleteSelectionCommand::removeNode at DeleteSelectionCommand.cpp:350 #7 0x030fbce1 in WebCore::DeleteSelectionCommand::handleGeneralDelete at DeleteSelectionCommand.cpp:446 #8 0x030fec85 in WebCore::DeleteSelectionCommand::doApply at DeleteSelectionCommand.cpp:753 #9 0x03143c63 in WebCore::EditCommand::apply at EditCommand.cpp:101 #10 0x030180e3 in WebCore::CompositeEditCommand::applyCommandToComposite at CompositeEditCommand.cpp:97 #11 0x03019ddc in WebCore::CompositeEditCommand::deleteSelection at CompositeEditCommand.cpp:345 #12 0x035bd282 in WebCore::TypingCommand::deleteKeyPressed at TypingCommand.cpp:431 #13 0x035bd769 in WebCore::TypingCommand::doApply at TypingCommand.cpp:254 #14 0x03143c63 in WebCore::EditCommand::apply at EditCommand.cpp:101 #15 0x035bdfa0 in WebCore::TypingCommand::deleteKeyPressed at TypingCommand.cpp:95 #16 0x0314de99 in executeDelete at EditorCommand.cpp:280 #17 0x0314f7ac in WebCore::Editor::Command::execute at EditorCommand.cpp:1371 #18 0x0310b69c in WebCore::Document::execCommand at Document.cpp:3120 #19 0x032d1630 in WebCore::jsDocumentPrototypeFunctionExecCommand at JSDocument.cpp:804 #20 0x004ef496 in KJS::Machine::privateExecute at Machine.cpp:2377 #21 0x004f1417 in KJS::Machine::execute at Machine.cpp:798 #22 0x0045bb4f in KJS::JSFunction::call at JSFunction.cpp:67 #23 0x0045bbeb in KJS::call at CallData.cpp:39 #24 0x00468199 in functionProtoFuncCall at FunctionPrototype.cpp:124 #25 0x004ef496 in KJS::Machine::privateExecute at Machine.cpp:2377 #26 0x004f1417 in KJS::Machine::execute at Machine.cpp:798 #27 0x0045bb4f in KJS::JSFunction::call at JSFunction.cpp:67 #28 0x0045bbeb in KJS::call at CallData.cpp:39 #29 0x00468199 in functionProtoFuncCall at FunctionPrototype.cpp:124 #30 0x004ef496 in KJS::Machine::privateExecute at Machine.cpp:2377 #31 0x004f1417 in KJS::Machine::execute at Machine.cpp:798 #32 0x0045bb4f in KJS::JSFunction::call at JSFunction.cpp:67 #33 0x0045bbeb in KJS::call at CallData.cpp:39 #34 0x03618d7a in WebCore::JSAbstractEventListener::handleEvent at JSEventListener.cpp:95 #35 0x0316a70f in WebCore::EventTarget::handleLocalEvents at EventTarget.cpp:325 #36 0x0316b82c in WebCore::EventTargetNode::handleLocalEvents at EventTargetNode.cpp:116 #37 0x0316ade4 in WebCore::EventTarget::dispatchGenericEvent at EventTarget.cpp:235 #38 0x0316bace in WebCore::EventTargetNode::dispatchEvent at EventTargetNode.cpp:132 #39 0x03022345 in dispatchChildInsertionEvents at ContainerNode.cpp:954 #40 0x0302391d in WebCore::ContainerNode::insertBefore at ContainerNode.cpp:217 #41 0x03289392 in WebCore::InsertNodeBeforeCommand::doApply at InsertNodeBeforeCommand.cpp:51 #42 0x03143c63 in WebCore::EditCommand::apply at EditCommand.cpp:101 #43 0x030180e3 in WebCore::CompositeEditCommand::applyCommandToComposite at CompositeEditCommand.cpp:97 #44 0x03018783 in WebCore::CompositeEditCommand::insertNodeBefore at CompositeEditCommand.cpp:134 #45 0x0301955d in WebCore::CompositeEditCommand::insertNodeAt at CompositeEditCommand.cpp:162 #46 0x034b85c5 in WebCore::ReplaceSelectionCommand::insertNodeAtAndUpdateNodesInserted at ReplaceSelectionCommand.cpp:979 #47 0x034bb1fb in WebCore::ReplaceSelectionCommand::doApply at ReplaceSelectionCommand.cpp:751 #48 0x03143c63 in WebCore::EditCommand::apply at EditCommand.cpp:101 #49 0x03143cdb in WebCore::applyCommand at EditCommand.cpp:236 #50 0x03141189 in WebCore::DragController::concludeDrag at DragController.cpp:413 #51 0x031416f4 in WebCore::DragController::performDrag at DragController.cpp:193 #52 0x0023a707 in -[WebView performDragOperation:] at WebView.mm:2654 #53 0x96321e79 in NSCoreDragReceiveProc #54 0x907e355c in DoDropMessage #55 0x907e34d2 in SendDropMessage #56 0x907e083a in DragInApplication #57 0x907df2de in CoreDragStartDragging #58 0x9631fcfd in -[NSCoreDragManager _dragUntilMouseUp:accepted:] #59 0x9631ec1e in -[NSCoreDragManager dragImage:fromWindow:at:offset:event:pasteboard:source:slideBack:] #60 0x9631e668 in -[NSWindow(NSDrag) dragImage:at:offset:event:pasteboard:source:slideBack:] #61 0x001e3132 in -[WebHTMLView dragImage:at:offset:event:pasteboard:source:slideBack:] at WebHTMLView.mm:3157 #62 0x001bccb0 in WebDragClient::startDrag at WebDragClient.mm:116 #63 0x0313def1 in WebCore::DragController::doSystemDrag at DragController.cpp:741 #64 0x0313e447 in WebCore::DragController::doImageDrag at DragController.cpp:728 #65 0x0313fc45 in WebCore::DragController::startDrag at DragController.cpp:646 #66 0x03160fb8 in WebCore::EventHandler::handleDrag at EventHandler.cpp:1896 #67 0x031610a5 in WebCore::EventHandler::handleMouseDraggedEvent at EventHandler.cpp:378 #68 0x03163817 in WebCore::EventHandler::handleMouseMoveEvent at EventHandler.cpp:1147 #69 0x031681e3 in WebCore::EventHandler::mouseDragged at EventHandlerMac.mm:509 #70 0x001e3224 in -[WebHTMLView mouseDragged:] at WebHTMLView.mm:3170 #71 0x9611d4c5 in -[NSWindow sendEvent:] #72 0x000296d3 in ?? #73 0x960e9431 in -[NSApplication sendEvent:] #74 0x00029250 in ?? #75 0x96046e27 in -[NSApplication run] #76 0x96014030 in NSApplicationMain #77 0x000b4de6 in ?? Created attachment 22480 [details]
test case
Um... I've also seen this test case fail on:
ASSERTION FAILED: containerA && containerB
(/Users/eseidel/Projects/WebKit/WebCore/dom/Range.cpp:449 static short int WebCore::Range::compareBoundaryPoints(WebCore::Node*, int, WebCore::Node*, int))
Created attachment 22482 [details]
Fix crash in Google presentations when dragging images into a presentation
WebCore/ChangeLog | 13 +++++++++++++
WebCore/editing/ReplaceSelectionCommand.cpp | 3 ++-
WebCore/manual-tests/remove-on-drop-crash.html | 10 ++++++++++
3 files changed, 25 insertions(+), 1 deletions(-)
Comment on attachment 22482 [details]
Fix crash in Google presentations when dragging images into a presentation
Justin should review this, I'm not 100% certain this is the right way to fix this.
Comment on attachment 22482 [details]
Fix crash in Google presentations when dragging images into a presentation
if you're sure that m_firstNodeInserted is not in the document because it's removed by Google's code and not because of some other WebCore bug, then r=me.
(In reply to comment #12) > (From update of attachment 22482 [details] [edit]) > if you're sure that m_firstNodeInserted is not in the document because it's > removed by Google's code and not because of some other WebCore bug, then r=me. Yeah, I definitely caught it in the debugger. A DOMNodeInserted event had fired and we were acting on a "delete" editing event caused by their event handler. See the above stack trace for verification. Comment on attachment 22482 [details]
Fix crash in Google presentations when dragging images into a presentation
Justin r+'d this already.
Eric, are you planning on landing this? Looks like I already did: http://trac.webkit.org/changeset/35465 Closing. |