Bug 28992

Summary: Assertion failure in CompositeEditCommand::moveParagraphs() and crash in Node::nodeIndex() when pasting
Product: WebKit Reporter: Alexey Proskuryakov <ap>
Component: HTML EditingAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: adele, eric, jparent, ojan, rniwa
Priority: P1 Keywords: InRadar
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
Attachments:
Description Flags
reduced test case (will crash)
none
Patch adele: review+

Description Alexey Proskuryakov 2009-09-04 16:53:10 PDT 
Opening the attached test case results in a crash in release builds, or an assertion failure in debug:

#0	0x03b3d6df in WebCore::CompositeEditCommand::moveParagraphs at CompositeEditCommand.cpp:815
#1	0x03b3e21b in WebCore::CompositeEditCommand::moveParagraph at CompositeEditCommand.cpp:747
#2	0x042db177 in WebCore::ReplaceSelectionCommand::mergeEndIfNeeded at ReplaceSelectionCommand.cpp:699
#3	0x042df692 in WebCore::ReplaceSelectionCommand::doApply at ReplaceSelectionCommand.cpp:960
#4	0x03d37ae3 in WebCore::EditCommand::apply at EditCommand.cpp:91
#5	0x03d37b77 in WebCore::applyCommand at EditCommand.cpp:217
#6	0x03d47097 in WebCore::executeInsertFragment at EditorCommand.cpp:196
#7	0x03d47122 in WebCore::executeInsertHTML at EditorCommand.cpp:479
#8	0x03d43d1f in WebCore::Editor::Command::execute at EditorCommand.cpp:1504
#9	0x03c45edd in WebCore::Document::execCommand at Document.cpp:3241
#10	0x03f509a2 in WebCore::jsDocumentPrototypeFunctionExecCommand at JSDocument.cpp:1867

In real life, this happens when pasting into a contenteditable div.

<rdar://7148712>
Comment 1 Alexey Proskuryakov 2009-09-04 17:08:20 PDT 
Created attachment 39102 [details]
reduced test case (will crash)
Comment 2 Enrica Casucci 2009-10-02 14:18:54 PDT 
Created attachment 40545 [details]
Patch
Comment 3 Adele Peterson 2009-10-02 14:29:27 PDT 
Comment on attachment 40545 [details]
Patch

r=me! I'll commit this.
Comment 4 Adele Peterson 2009-10-02 14:34:25 PDT 
Committed revision 49041.