Created attachment 215905 [details] Test case The failing test: <details></details> <font>A</font> <style></style> <iframe onload=" document.designMode='on'; document.execCommand('selectall'); document.execCommand('italic'); document.execCommand('RemoveFormat');" seamless=" "> </iframe> The backtrace: Program received signal SIGSEGV, Segmentation fault. [Switching to LWP 21412] 0x00007ffff4af0ac1 in WTFCrash () at /home/reni/Data/REPOS/webkitnix/Source/WTF/wtf/Assertions.cpp:342 342 *(int *)(uintptr_t)0xbbadbeef = 0; (gdb) bt #0 0x00007ffff4af0ac1 in WTFCrash () at /home/reni/Data/REPOS/webkitnix/Source/WTF/wtf/Assertions.cpp:342 #1 0x00007ffff335e245 in WebCore::InsertNodeBeforeCommand::InsertNodeBeforeCommand (this=0x8326a0, insertChild=<incomplete type>, refChild=<incomplete type>, shouldAssumeContentIsAlwaysEditable=WebCore::DoNotAssumeContentIsAlwaysEditable) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/InsertNodeBeforeCommand.cpp:44 #2 0x00007ffff3318759 in WebCore::InsertNodeBeforeCommand::create (childToInsert=<incomplete type>, childToInsertBefore=<incomplete type>, shouldAssumeContentIsAlwaysEditable=WebCore::DoNotAssumeContentIsAlwaysEditable) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/InsertNodeBeforeCommand.h:38 #3 0x00007ffff3310118 in WebCore::CompositeEditCommand::insertNodeBefore (this=0x832020, insertChild=<incomplete type>, refChild=<incomplete type>, shouldAssumeContentIsAlwaysEditable=WebCore::DoNotAssumeContentIsAlwaysEditable) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/CompositeEditCommand.cpp:329 #4 0x00007ffff336b815 in WebCore::RemoveNodePreservingChildrenCommand::doApply (this=0x832020) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/RemoveNodePreservingChildrenCommand.cpp:52 #5 0x00007ffff330fb3c in WebCore::CompositeEditCommand::applyCommandToComposite (this=0x821650, prpCommand=<incomplete type>) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/CompositeEditCommand.cpp:262 #6 0x00007ffff3310ae0 in WebCore::CompositeEditCommand::removeNodePreservingChildren (this=0x821650, node=<incomplete type>, shouldAssumeContentIsAlwaysEditable=WebCore::DoNotAssumeContentIsAlwaysEditable) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/CompositeEditCommand.cpp:405 #7 0x00007ffff33044d5 in WebCore::ApplyStyleCommand::removeInlineStyleFromElement (this=0x821650, style=0x831690, element=<incomplete type>, mode=WebCore::ApplyStyleCommand::RemoveIfNeeded, extractedStyle=0x74add0) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/ApplyStyleCommand.cpp:890 #8 0x00007ffff3305175 in WebCore::ApplyStyleCommand::pushDownInlineStyleAroundNode (this=0x821650, style=0x831690, targetNode=0x8bcbd0) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/ApplyStyleCommand.cpp:1051 #9 0x00007ffff33057c3 in WebCore::ApplyStyleCommand::removeInlineStyle (this=0x821650, style=0x831690, start=..., end=...) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/ApplyStyleCommand.cpp:1104 #10 0x00007ffff3302a12 in WebCore::ApplyStyleCommand::applyInlineStyle (this=0x821650, style=0x831690) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/ApplyStyleCommand.cpp:630 #11 0x00007ffff32ffe57 in WebCore::ApplyStyleCommand::doApply (this=0x821650) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/ApplyStyleCommand.cpp:220 #12 0x00007ffff330fb3c in WebCore::CompositeEditCommand::applyCommandToComposite (this=0x831290, prpCommand=<incomplete type>) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/CompositeEditCommand.cpp:262 #13 0x00007ffff336afc5 in WebCore::RemoveFormatCommand::doApply (this=0x831290) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/RemoveFormatCommand.cpp:92 #14 0x00007ffff330f8fc in WebCore::CompositeEditCommand::apply (this=0x831290) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/CompositeEditCommand.cpp:211 #15 0x00007ffff330f6fc in WebCore::applyCommand (command=<incomplete type>) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/CompositeEditCommand.cpp:170 #16 0x00007ffff3333335 in WebCore::Editor::removeFormattingAndStyle (this=0x7a1e60) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/Editor.cpp:700 #17 0x00007ffff3347652 in WebCore::executeRemoveFormat (frame=...) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/EditorCommand.cpp:977 #18 0x00007ffff33491af in WebCore::Editor::Command::execute (this=0x7fffffffa810, parameter=..., triggeringEvent=0x0) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/EditorCommand.cpp:1713 #19 0x00007ffff32106ac in WebCore::Document::execCommand (this=0x81b610, commandName=..., userInterface=false, value=...) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/dom/Document.cpp:4110 #20 0x00007ffff3fab309 in WebCore::jsDocumentPrototypeFunctionExecCommand (exec=0x7fffa37fef50) at /home/reni/Data/REPOS/webkitnix/WebKitBuild/Debug/DerivedSources/WebCore/JSDocument.cpp:2705 #21 0x00007fffaa282105 in ?? () #22 0x00007fffffffa950 in ?? () #23 0x00007ffff4875638 in llint_op_call () from /home/reni/Data/REPOS/webkitnix/WebKitBuild/Debug/lib/libWebKitNix.so.0 #24 0x00007fffaa282940 in ?? () #25 0x0000000000689dd8 in ?? () #26 0x0000000000000001 in ?? () #27 0x0000000000000001 in ?? () #28 0x00000000ffffffff in ?? () ---Type <return> to continue, or q <return> to quit--- #29 0x0000000000000000 in ?? ()
Created attachment 273733 [details] Test case New test case. Checked on: OS: Mac OS X 10.11.1 (x86_64), x86_64 Build: ASAN debug Version: ecad464
This still occurs under r204037.
<rdar://problem/27684325>