It produces this crash running some layout tests like editing/pasteboard/19644-1.html Program terminated with signal 11, Segmentation fault. #0 0x7a19e988 in BlackBerry::WebKit::InputHandler::requestCheckingOfString (this=0x80b4470, spellCheckRequest=...) at /home/cgarcia/rim/webkit/Source/WebKit/blackberry/WebKitSupport/InputHandler.cpp:634 634 ASSERT(spellCheckRequest->data().processType() == TextCheckingProcessIncremental); (gdb) bt #0 0x7a19e988 in BlackBerry::WebKit::InputHandler::requestCheckingOfString (this=0x80b4470, spellCheckRequest=...) at /home/cgarcia/rim/webkit/Source/WebKit/blackberry/WebKitSupport/InputHandler.cpp:634 #1 0x7a1637b6 in WebCore::EditorClientBlackBerry::requestCheckingOfString (this=0x80d1488, textCheckingRequest=...) at /home/cgarcia/rim/webkit/Source/WebKit/blackberry/WebCoreSupport/EditorClientBlackBerry.cpp:585 #2 0x7c9a8e5e in WebCore::SpellChecker::invokeRequest (this=0x80d3e20, request=...) at /home/cgarcia/rim/webkit/Source/WebCore/editing/SpellChecker.cpp:187 #3 0x7c9a8d94 in WebCore::SpellChecker::requestCheckingFor (this=0x80d3e20, request=...) at /home/cgarcia/rim/webkit/Source/WebCore/editing/SpellChecker.cpp:178 #4 0x7c96fda4 in WebCore::Editor::replaceSelectionWithFragment (this=0x811f7dc, fragment=..., selectReplacement=false, smartReplace=false, matchStyle=false) at /home/cgarcia/rim/webkit/Source/WebCore/editing/Editor.cpp:485 #5 0x7c96ee4a in WebCore::Editor::handleTextEvent (this=0x811f7dc, event=0x99cdb48) at /home/cgarcia/rim/webkit/Source/WebCore/editing/Editor.cpp:230 #6 0x7cd315de in WebCore::EventHandler::defaultTextInputEventHandler (this=0x811f928, event=0x99cdb48) at /home/cgarcia/rim/webkit/Source/WebCore/page/EventHandler.cpp:3635 #7 0x7c8e8e68 in WebCore::Node::defaultEventHandler (this=0x99c90e0, event=0x99cdb48) at /home/cgarcia/rim/webkit/Source/WebCore/dom/Node.cpp:2491 #8 0x7c8b625e in WebCore::EventDispatcher::dispatchEventPostProcess (this=0x7cfe960, preDispatchEventHandlerResult=0x0) at /home/cgarcia/rim/webkit/Source/WebCore/dom/EventDispatcher.cpp:210 #9 0x7c8b57e8 in WebCore::EventDispatcher::dispatch (this=0x7cfe960) at /home/cgarcia/rim/webkit/Source/WebCore/dom/EventDispatcher.cpp:127 #10 0x7c8b4c8e in WebCore::EventDispatchMediator::dispatchEvent (this=0x99c5b78, dispatcher=0x7cfe960) at /home/cgarcia/rim/webkit/Source/WebCore/dom/EventDispatchMediator.cpp:54 #11 0x7c8b4f84 in WebCore::EventDispatcher::dispatchEvent (node=0x99c90e0, mediator=...) at /home/cgarcia/rim/webkit/Source/WebCore/dom/EventDispatcher.cpp:56 #12 0x7c8e80c6 in WebCore::Node::dispatchEvent (this=0x99c90e0, event=...) at /home/cgarcia/rim/webkit/Source/WebCore/dom/Node.cpp:2344 #13 0x7c8c118a in WebCore::EventTarget::dispatchEvent (this=0x99c90e0, event=..., ec=@0x7cfea8c: 0) at /home/cgarcia/rim/webkit/Source/WebCore/dom/EventTarget.cpp:147 #14 0x7c96f7b0 in WebCore::Editor::pasteAsFragment (this=0x811f7dc, pastingFragment=..., smartReplace=false, matchStyle=false) at /home/cgarcia/rim/webkit/Source/WebCore/editing/Editor.cpp:418 #15 0x7c96f9f8 in WebCore::Editor::pasteWithPasteboard (this=0x811f7dc, pasteboard=0x99c5950, allowPlainText=true) at /home/cgarcia/rim/webkit/Source/WebCore/editing/Editor.cpp:440 #16 0x7c97242c in WebCore::Editor::paste (this=0x811f7dc) at /home/cgarcia/rim/webkit/Source/WebCore/editing/Editor.cpp:1093 #17 0x7c980ecc in WebCore::executePaste (frame=0x811f3b0, source=WebCore::CommandFromDOM) at /home/cgarcia/rim/webkit/Source/WebCore/editing/EditorCommand.cpp:919 #18 0x7c98298e in WebCore::Editor::Command::execute (this=0x7cfeb74, parameter=..., triggeringEvent=0x0) at /home/cgarcia/rim/webkit/Source/WebCore/editing/EditorCommand.cpp:1727 #19 0x7c8472fc in WebCore::Document::execCommand (this=0x827b3e8, commandName=..., userInterface=false, value=...) at /home/cgarcia/rim/webkit/Source/WebCore/dom/Document.cpp:4262 #20 0x7d47ca04 in WebCore::jsDocumentPrototypeFunctionExecCommand (exec=0x83000e8) at /home/cgarcia/rim/webkit/WebKitBuild/armle-v7/Debug/DerivedSources/WebCore/JSDocument.cpp:2629 There's a comment in there: // Batch requests which are generally created by us on focus, should not exceed this limit. Check that this is in fact of Incremental type. As the comment says, batch requests are generally created on input field focus, but not only. The Editor also creates Batch requests when replacing selection with pasted text and the pasted text can be longer than the spell checker limit, as it's happening with this layout test.
Created attachment 199019 [details] Patch Simply remove the assert and the comment since it would be even more confusing without the assert.
sounds okay to me =)
Comment on attachment 199019 [details] Patch Ok.
Comment on attachment 199019 [details] Patch Clearing flags on attachment: 199019 Committed r148978: <http://trac.webkit.org/changeset/148978>
All reviewed patches have been landed. Closing bug.