Bug 271858

Summary:	Release assert in canExecuteScripts via Editor::setComposition through FrameSelection::willBeRemovedFromFrame
Product:	WebKit	Reporter:	Ryosuke Niwa <rniwa>
Component:	HTML Editing	Assignee:	Ryosuke Niwa <rniwa>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	ddkilzer, wenson_hsieh
Priority:	P2	Keywords:	InRadar
Version:	Other
Hardware:	Unspecified
OS:	Unspecified
See Also:	https://bugs.webkit.org/show_bug.cgi?id=273139
Bug Depends on:
Bug Blocks:	273738

Ryosuke Niwa

Reported 2024-03-28 15:51:03 PDT

e.g. 0 com.apple.WebCore 0x7ff831e0bf22 WTFCrashWithInfo(int, char const*, char const*, int) + 18 (/AppleInternal/Library/BuildRoots/52864998-4bb1-11ed-960e-2e32217d8374/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX13.0.Internal.sdk/usr/local/include/wtf/Assertions.h:754) 1 com.apple.WebCore 0x7ff831c213d0 WebCore::ScriptController::canExecuteScripts(WebCore::ReasonForCallingCanExecuteScripts) + 480 (/AppleInternal/Library/BuildRoots/52864998-4bb1-11ed-960e-2e32217d8374/Library/Caches/com.apple.xbs/Sources/WebCore/Source/WebCore/./bindings/js/ScriptController.cpp:758) 2 com.apple.WebCore 0x7ff832cf382c WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext&, WebCore::Event&) + 284 (/AppleInternal/Library/BuildRoots/52864998-4bb1-11ed-960e-2e32217d8374/Library/Caches/com.apple.xbs/Sources/WebCore/Source/WebCore/./bindings/js/JSEventListener.cpp:160) 3 com.apple.WebCore 0x7ff833050736 WebCore::EventTarget::innerInvokeEventListeners(WebCore::Event&, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener, WTF::RawPtrTraits<WebCore::RegisteredEventListener>, WTF::DefaultRefDerefTraits<WebCore::RegisteredEventListener> >, 1ul, WTF::CrashOnOverflow, 2ul, WTF::FastMalloc>, WebCore::EventTarget::EventInvokePhase) + 310 (/AppleInternal/Library/BuildRoots/52864998-4bb1-11ed-960e-2e32217d8374/Library/Caches/com.apple.xbs/Sources/WebCore/Source/WebCore/./dom/EventTarget.cpp:364) 4 com.apple.WebCore 0x7ff833050336 WebCore::EventTarget::fireEventListeners(WebCore::Event&, WebCore::EventTarget::EventInvokePhase) + 342 (/AppleInternal/Library/BuildRoots/52864998-4bb1-11ed-960e-2e32217d8374/Library/Caches/com.apple.xbs/Sources/WebCore/Source/WebCore/./dom/EventTarget.cpp:296) 5 com.apple.WebCore 0x7ff833046ee6 WebCore::dispatchEventInDOM(WebCore::Event&, WebCore::EventPath const&) + 214 (/AppleInternal/Library/BuildRoots/52864998-4bb1-11ed-960e-2e32217d8374/Library/Caches/com.apple.xbs/Sources/WebCore/Source/WebCore/./dom/EventDispatcher.cpp:109) 6 com.apple.WebCore 0x7ff833046220 WebCore::EventDispatcher::dispatchEvent(WebCore::Node&, WebCore::Event&) + 688 (/AppleInternal/Library/BuildRoots/52864998-4bb1-11ed-960e-2e32217d8374/Library/Caches/com.apple.xbs/Sources/WebCore/Source/WebCore/./dom/EventDispatcher.cpp:190) 7 com.apple.WebCore 0x7ff833124e0c WebCore::Editor::setComposition(WTF::String const&, WebCore::Editor::SetCompositionMode) + 476 (/AppleInternal/Library/BuildRoots/52864998-4bb1-11ed-960e-2e32217d8374/Library/Caches/com.apple.xbs/Sources/WebCore/Source/WebCore/./editing/Editor.cpp:2104) 8 com.apple.WebKit 0x7ff91527e96e WebKit::WebPage::didChangeSelectionOrOverflowScrollPosition() + 400 (/AppleInternal/Library/BuildRoots/52864998-4bb1-11ed-960e-2e32217d8374/Library/Caches/com.apple.xbs/Sources/WebKit/Source/WebKit/WebProcess/WebPage/WebPage.cpp:6324) 9 com.apple.WebKit 0x7ff91494d950 WebKit::WebEditorClient::respondToChangedSelection(WebCore::Frame*) + 112 (/AppleInternal/Library/BuildRoots/52864998-4bb1-11ed-960e-2e32217d8374/Library/Caches/com.apple.xbs/Sources/WebKit/Source/WebKit/WebProcess/WebPage/WebPage.cpp:6271) 10 com.apple.WebCore 0x7ff83313cdbc WebCore::FrameSelection::setSelectionWithoutUpdatingAppearance(WebCore::VisibleSelection const&, WTF::OptionSet<WebCore::FrameSelection::SetSelectionOption>, WebCore::FrameSelection::CursorAlignOnScroll, WebCore::TextGranularity) + 1932 (/AppleInternal/Library/BuildRoots/52864998-4bb1-11ed-960e-2e32217d8374/Library/Caches/com.apple.xbs/Sources/WebCore/Source/WebCore/./editing/Editor.cpp:3710) 11 com.apple.WebCore 0x7ff833144358 WebCore::FrameSelection::willBeRemovedFromFrame() + 200 (/AppleInternal/Library/BuildRoots/52864998-4bb1-11ed-960e-2e32217d8374/Library/Caches/com.apple.xbs/Sources/WebCore/Source/WebCore/./editing/FrameSelection.cpp:1650) 12 com.apple.WebCore 0x7ff832ff526e WebCore::Document::willBeRemovedFromFrame() + 830 (/AppleInternal/Library/BuildRoots/52864998-4bb1-11ed-960e-2e32217d8374/Library/Caches/com.apple.xbs/Sources/WebCore/Source/WebCore/./dom/Document.cpp:2727) 13 com.apple.WebCore 0x7ff833613304 WebCore::Frame::setView(WTF::RefPtr<WebCore::FrameView, WTF::RawPtrTraits<WebCore::FrameView>, WTF::DefaultRefDerefTraits<WebCore::FrameView> >&&) + 68 (/AppleInternal/Library/BuildRoots/52864998-4bb1-11ed-960e-2e32217d8374/Library/Caches/com.apple.xbs/Sources/WebCore/Source/WebCore/./page/Frame.cpp:259) 14 com.apple.WebCore 0x7ff831c9ef92 WebCore::FrameLoader::detachFromParent() + 354 (/AppleInternal/Library/BuildRoots/52864998-4bb1-11ed-960e-2e32217d8374/Library/Caches/com.apple.xbs/Sources/WebCore/Source/WebCore/./loader/FrameLoader.cpp:2746) 15 com.apple.WebCore 0x7ff831cf7732 WebCore::FrameLoader::frameDetached() + 98 (/AppleInternal/Library/BuildRoots/52864998-4bb1-11ed-960e-2e32217d8374/Library/Caches/com.apple.xbs/Sources/WebCore/Source/WebCore/./loader/FrameLoader.cpp:2837)

Attachments
Add attachment proposed patch, testcase, etc.

Ryosuke Niwa

Comment 1 2024-03-28 15:51:21 PDT

<rdar://102563363>

Ryosuke Niwa

Comment 2 2024-03-28 15:56:07 PDT

Pull request: https://github.com/WebKit/WebKit/pull/26583

EWS

Comment 3 2024-04-02 13:46:49 PDT

Committed 276962@main (479a96130343): <https://commits.webkit.org/276962@main> Reviewed commits have been landed. Closing PR #26583 and removing active labels.

David Kilzer (:ddkilzer)

Comment 4 2024-05-07 08:54:47 PDT

This caused: Bug 273738: TestWebKitAPI.ScrollViewScrollabilityTests.ScrollableWithOverflowHiddenWhenZoomed fails on iOS Simulator

Note You need to log in before you can comment on or make changes to this bug.