Bug 9429 – Assertion fails in HTMLInputElement::setValueFromRenderer after deleting text

• Component: Forms
• Status: CLOSED DUPLICATE

[John Sullivan]

To reproduce:

1. Visit http://mapquest.com -- the insertion point is in an address field
2. type one character (or more)
3. backspace over the typed text

This hits:

    ASSERT(value == constrainValue(value));

in HTMLInputElement::setValueFromRenderer

Partial backtrace is:

#0  0x01d9de90 in WebCore::HTMLInputElement::setValueFromRenderer (this=0x28ea5eb0, value=@0xbfffe410) at /Volumes/Big/johnsullivan/Projects/Labyrinth/OpenSource/WebCore/html/HTMLInputElement.cpp:1068
#1  0x01eec444 in WebCore::RenderTextField::subtreeHasChanged (this=0x28ea617c) at /Volumes/Big/johnsullivan/Projects/Labyrinth/OpenSource/WebCore/rendering/RenderTextField.cpp:239
#2  0x01f921c4 in WebCore::HTMLTextFieldInnerElement::defaultEventHandler (this=0x28ea6230, evt=0x29199780) at /Volumes/Big/johnsullivan/Projects/Labyrinth/OpenSource/WebCore/html/HTMLTextFieldInnerElement.cpp:56
#3  0x01f952a8 in WebCore::EventTargetNode::dispatchGenericEvent (this=0x28ea6230, e=@0xbfffe568, tempEvent=true) at /Volumes/Big/johnsullivan/Projects/Labyrinth/OpenSource/WebCore/dom/EventTargetNode.cpp:249
#4  0x01f95b48 in WebCore::EventTargetNode::dispatchEvent (this=0x28ea6230, e=@0xbfffe5c8, ec=@0xbfffe5cc, tempEvent=true) at /Volumes/Big/johnsullivan/Projects/Labyrinth/OpenSource/WebCore/dom/EventTargetNode.cpp:282
#5  0x01dc055c in WebCore::dispatchEditableContentChangedEvent (root=0x28ea6230) at /Volumes/Big/johnsullivan/Projects/Labyrinth/OpenSource/WebCore/page/Frame.cpp:2026
#6  0x01dc09c4 in WebCore::Frame::appliedEditing (this=0x1395e730, cmd=@0xbfffe708) at /Volumes/Big/johnsullivan/Projects/Labyrinth/OpenSource/WebCore/page/Frame.cpp:2035
#7  0x01f5bc1c in WebCore::TypingCommand::typingAddedToOpenCommand (this=0x291985a0) at /Volumes/Big/johnsullivan/Projects/Labyrinth/OpenSource/WebCore/editing/TypingCommand.cpp:246
#8  0x01f5c094 in WebCore::TypingCommand::deleteKeyPressed (this=0x291985a0) at /Volumes/Big/johnsullivan/Projects/Labyrinth/OpenSource/WebCore/editing/TypingCommand.cpp:346
#9  0x01f5c9b0 in WebCore::TypingCommand::deleteKeyPressed (document=0x140c0c00, smartDelete=false) at /Volumes/Big/johnsullivan/Projects/Labyrinth/OpenSource/WebCore/editing/TypingCommand.cpp:64
#10 0x01e010a4 in -[WebCoreFrameBridge deleteKeyPressedWithSmartDelete:] (self=0x1395f0f0, _cmd=0x12ff9dc, smartDelete=0 '\0') at /Volumes/Big/johnsullivan/Projects/Labyrinth/OpenSource/WebCore/bridge/mac/WebCoreFrameBridge.mm:2160
#11 0x01260eac in -[WebHTMLView(WebHTMLViewFileInternal) _deleteRange:killRing:prepend:smartDeleteOK:deletionAction:] (self=0x139f77a0, _cmd=0x12ff1dc, range=0x291cae10, killRing=0 '\0', prepend=0 '\0', smartDeleteOK=0 '\0', deletionAction=deleteKeyAction) at /Volumes/Big/johnsullivan/Projects/Labyrinth/OpenSource/WebKit/WebView/WebHTMLView.m:606
#12 0x0127a2dc in -[WebHTMLView _deleteWithDirection:granularity:killRing:isTypingAction:] (self=0x139f77a0, _cmd=0x12fda00, direction=WebBridgeSelectBackward, granularity=WebBridgeSelectByCharacter, killRing=0 '\0', isTypingAction=1 '\001') at /Volumes/Big/johnsullivan/Projects/Labyrinth/OpenSource/WebKit/WebView/WebHTMLView.m:4540
#13 0x0127a40c in -[WebHTMLView deleteBackward:] (self=0x139f77a0, _cmd=0x90a94df0, sender=0x0) at /Volumes/Big/johnsullivan/Projects/Labyrinth/OpenSource/WebKit/WebView/WebHTMLView.m:4555
<...>

Not sure if this more of a Forms problem or more of an HTML editing problem. I haven't tried it on a release build so I don't know if there are symptoms beyond the assertion failure.

[David Kilzer (:ddkilzer)]

*** This bug has been marked as a duplicate of 9358 ***

[John Sullivan]

Yup, closing.