Summary: | [GTK] REGRESSION(r267329): imported/blink/editing/undo/crash-redo-with-iframes.html is crashing | ||||||||
---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Diego Pino <dpino> | ||||||
Component: | New Bugs | Assignee: | Lauro Moura <lmoura> | ||||||
Status: | RESOLVED FIXED | ||||||||
Severity: | Normal | CC: | bugs-noreply, darin, ews-watchlist, lmoura, mifenton, webkit-bug-importer | ||||||
Priority: | P2 | Keywords: | InRadar | ||||||
Version: | WebKit Nightly Build | ||||||||
Hardware: | Unspecified | ||||||||
OS: | Unspecified | ||||||||
Bug Depends on: | |||||||||
Bug Blocks: | 216739 | ||||||||
Attachments: |
|
Description
Diego Pino
2020-09-21 07:02:05 PDT
What kind of crash is this? A null pointer dereference? This global selection feature is a GTK-only feature related to the feature of Unix window systems, so it’s not surprising that the crash is GTK-only. I’d like to help with this; to help I will need some more information. What kind of crash is it? Most likely we just have to add some checks of some kind to serializePreservingVisualAppearanceInternal, but to understand what I need to know what kind of crash this is. Created attachment 409318 [details]
Debug crash log
Here's the stack trace from the debug log. It fails the assertion at the start of serializeNodes:
Top of the stack:
Thread 1 (Thread 0x7ff19326e9c0 (LWP 115)):
#0 WTFCrash() () at ../../Source/WTF/wtf/Assertions.cpp:295
#1 0x00007ff1aa6fc197 in CRASH_WITH_INFO(...) () at DerivedSources/ForwardingHeaders/wtf/Assertions.h:713
#2 0x00007ff1ad8bb03f in WebCore::StyledMarkupAccumulator::serializeNodes(WebCore::Position const&, WebCore::Position const&) (this=0x7ffe2f683570, start=..., end=...) at ../../Source/WebCore/editing/markup.cpp:587
#3 0x00007ff1ad8bccf9 in WebCore::serializePreservingVisualAppearanceInternal(WebCore::Position const&, WebCore::Position const&, WTF::Vector<WebCore::Node*, 0, WTF::CrashOnOverflow, 16, WTF::FastMalloc>*, WebCore::ResolveURLs, WebCore::SerializeComposedTree, WebCore::AnnotateForInterchange, WebCore::ConvertBlocksToInlines, WebCore::StandardFontFamilySerializationMode, WebCore::MSOListMode) (start=..., end=..., nodes=0x0, resolveURLs=WebCore::ResolveURLs::YesExcludingLocalFileURLsForPrivacy, serializeComposedTree=WebCore::SerializeComposedTree::No, annotate=WebCore::AnnotateForInterchange::Yes, convertBlocksToInlines=WebCore::ConvertBlocksToInlines::No, standardFontFamilySerializationMode=WebCore::StandardFontFamilySerializationMode::Keep, msoListMode=WebCore::MSOListMode::DoNotPreserve) at ../../Source/WebCore/editing/markup.cpp:878
#4 0x00007ff1ad8bd478 in WebCore::serializePreservingVisualAppearance(WebCore::VisibleSelection const&, WebCore::ResolveURLs, WebCore::SerializeComposedTree, WTF::Vector<WebCore::Node*, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>*) (selection=..., resolveURLs=WebCore::ResolveURLs::YesExcludingLocalFileURLsForPrivacy, serializeComposedTree=WebCore::SerializeComposedTree::No, nodes=0x0) at ../../Source/WebCore/editing/markup.cpp:946
#5 0x00007ff1abaa15ad in WebKit::WebEditorClient::updateGlobalSelection(WebCore::Frame*) (this=0x7ff1929f62b8, frame=0x7ff1929a4100) at ../../Source/WebKit/WebProcess/WebCoreSupport/gtk/WebEditorClientGtk.cpp:147
#6 0x00007ff1aba4daca in WebKit::WebEditorClient::respondToChangedSelection(WebCore::Frame*) (this=0x7ff1929f62b8, frame=0x7ff1929a4100) at ../../Source/WebKit/WebProcess/WebCoreSupport/WebEditorClient.cpp:229
#7 0x00007ff1ad81c583 in WebCore::Editor::respondToChangedSelection(WebCore::VisibleSelection const&, WTF::OptionSet<WebCore::FrameSelection::SetSelectionOption>) (this=0x7ff1929784e0, options=...) at ../../Source/WebCore/editing/Editor.cpp:3630
#8 0x00007ff1ad829170 in WebCore::FrameSelection::setSelectionWithoutUpdatingAppearance(WebCore::VisibleSelection const&, WTF::OptionSet<WebCore::FrameSelection::SetSelectionOption>, WebCore::FrameSelection::CursorAlignOnScroll, WebCore::TextGranularity) (this=0x7ff19297aa80, newSelectionPossiblyWithoutDirection=..., options=..., align=WebCore::FrameSelection::AlignCursorOnScrollIfNeeded, granularity=WebCore::TextGranularity::CharacterGranularity) at ../../Source/WebCore/editing/FrameSelection.cpp:395
#9 0x00007ff1ad82937d in WebCore::FrameSelection::setSelection(WebCore::VisibleSelection const&, WTF::OptionSet<WebCore::FrameSelection::SetSelectionOption>, WebCore::AXTextStateChangeIntent, WebCore::FrameSelection::CursorAlignOnScroll, WebCore::TextGranularity) (this=0x7ff19297aa80, selection=..., options=..., intent=..., align=WebCore::FrameSelection::AlignCursorOnScrollIfNeeded, granularity=WebCore::TextGranularity::CharacterGranularity) at ../../Source/WebCore/editing/FrameSelection.cpp:408
Can work around this for now by changing serializePreservingVisualAppearanceInternal to use < instead of == at the top: if (!(start < end)) return emptyString(); I suggest putting that in for now. Created attachment 409347 [details]
Patch
Committed r267457: <https://trac.webkit.org/changeset/267457> All reviewed patches have been landed. Closing bug and clearing flags on attachment 409347 [details]. |