Bug 223960 – [GTK] Test editing/execCommand/insert-image-in-composed-list.html crashes with GCC

• Component: WebKitGTK
• Status: RESOLVED DUPLICATE

[Carlos Alberto Lopez Perez]

Layout test editing/execCommand/insert-image-in-composed-list.html crashes in the GTK port when GCC (10.2.0 from flatpak SDK) is used as compiler.
The test doesn't crash when Clang (Release) is used.
And with GCC it only crashes on the Release build. On the Debug one it passes.
So this hints at some optimization done by GCC in Release mode triggering undefined behaviour or maybe a bug in GCC itself.

The crash has been happening since the test was added in bug 223545 (r274847)

The crash happens here:

Thread 1 (Thread 0x7f36450d19c0 (LWP 27320)):
#0  0x00007f364e24d400 in WebCore::Node::computeEditability(WebCore::Node::UserSelectAllTreatment, WebCore::Node::ShouldUpdateStyle) const () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#1  0x00007f364e24ea62 in WebCore::Node::rootEditableElement() const () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#2  0x00007f364e2cd2b7 in WebCore::DeleteSelectionCommand::removeRedundantBlocks() () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#3  0x00007f364e2e78a8 in WebCore::DeleteSelectionCommand::doApply() () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#4  0x00007f364f544dd2 in WebCore::CompositeEditCommand::applyCommandToComposite(WTF::Ref<WebCore::EditCommand, WTF::RawPtrTraits<WebCore::EditCommand> >&&) () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#5  0x00007f364f549e1b in WebCore::CompositeEditCommand::deleteSelection(bool, bool, bool, bool, bool) () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#6  0x00007f364e34c618 in WebCore::ReplaceSelectionCommand::doApply() () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#7  0x00007f364f544d01 in WebCore::CompositeEditCommand::apply() () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#8  0x00007f364e2eb2c8 in WebCore::executeInsertFragment(WebCore::Frame&, WTF::Ref<WebCore::DocumentFragment, WTF::RawPtrTraits<WebCore::DocumentFragment> >&&) () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#9  0x00007f364e2ec2f0 in WebCore::executeInsertImage(WebCore::Frame&, WebCore::Event*, WebCore::EditorCommandSource, WTF::String const&) () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#10 0x00007f364e1d5f05 in WebCore::Document::execCommand(WTF::String const&, bool, WTF::String const&) () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#11 0x00007f364d320294 in WebCore::jsDocumentPrototypeFunction_execCommand(JSC::JSGlobalObject*, JSC::CallFrame*) () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#12 0x00007f36043ff1d8 in  ()
#13 0x00007fff52b182e0 in  ()
#14 0x00007f3649b486ee in llint_op_call () at /app/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#15 0x0000000000000000 in  ()


All editing/ tests are currently skipped on WPE port, so this issue is only visible on GTK for now.

[Carlos Alberto Lopez Perez]

Created attachment 424703 [details]
full crash log with threads

[Carlos Alberto Lopez Perez]

Test marked as crashing in r275263

[Fujii Hironori]

*** This bug has been marked as a duplicate of bug 224801 ***