Bug 124776 - ASSERTION FAILED: !caretOffset in WebCore::RenderLineBreak::localCaretRect
Summary: ASSERTION FAILED: !caretOffset in WebCore::RenderLineBreak::localCaretRect
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: Layout and Rendering (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks: 116980
  Show dependency treegraph
 
Reported: 2013-11-22 07:33 PST by Renata Hodovan
Modified: 2016-08-03 13:24 PDT (History)
5 users (show)

See Also:


Attachments
Test case (223 bytes, text/html)
2013-11-22 07:33 PST, Renata Hodovan
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Renata Hodovan 2013-11-22 07:33:48 PST
Created attachment 217682 [details]
Test case

The test to reproduce the assertion failure:

<body alink="#ff0000" onload=" 
	document.designMode=&apos;on&apos;;     
	document.execCommand(&apos;selectall&apos;);         
	document.execCommand(&apos;inserthtml&apos;, false);  "> 
<span dir="rtl">אבג<br></span> 


The backtrace:

Program received signal SIGSEGV, Segmentation fault.
[Switching to LWP 20649]
0x00007ffff49c038d in WTFCrash () at /home/reni/Data/REPOS/webkitnix/Source/WTF/wtf/Assertions.cpp:341
341	    *(int *)(uintptr_t)0xbbadbeef = 0;
(gdb) bt
#0  0x00007ffff49c038d in WTFCrash () at /home/reni/Data/REPOS/webkitnix/Source/WTF/wtf/Assertions.cpp:341
#1  0x00007ffff39d7c83 in WebCore::RenderLineBreak::localCaretRect (this=0x7e9130, inlineBox=0x6cad60, caretOffset=1, extraWidthToEndOfLine=0x0)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/rendering/RenderLineBreak.cpp:140
#2  0x00007ffff3244655 in WebCore::VisiblePosition::localCaretRect (this=0x7fffffffbaf0, renderer=@0x7fffffffba90: 0x7e9130)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/VisiblePosition.cpp:617
#3  0x00007ffff3205712 in WebCore::CaretBase::updateCaretRect (this=0x669fd0, document=0x8505a0, caretPosition=...)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/FrameSelection.cpp:1273
#4  0x00007ffff3205a4d in WebCore::FrameSelection::localCaretRect (this=0x669fd0)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/FrameSelection.cpp:1317
#5  0x00007ffff3205d49 in WebCore::FrameSelection::recomputeCaretRect (this=0x669fd0)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/FrameSelection.cpp:1366
#6  0x00007ffff3207cc4 in WebCore::FrameSelection::updateAppearance (this=0x669fd0)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/FrameSelection.cpp:1753
#7  0x00007ffff35ffd3e in WebCore::FrameView::performPostLayoutTasks (this=0x8a4250)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/page/FrameView.cpp:2705
#8  0x00007ffff35fb00f in WebCore::FrameView::layout (this=0x8a4250, allowSubtree=true)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/page/FrameView.cpp:1338
#9  0x00007ffff30bc0f8 in WebCore::Document::updateLayout (this=0x8505a0) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/dom/Document.cpp:1801
#10 0x00007ffff30bc1d5 in WebCore::Document::updateLayoutIgnorePendingStylesheets (this=0x8505a0)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/dom/Document.cpp:1836
#11 0x00007ffff31d4cb9 in WebCore::DeleteSelectionCommand::fixupWhitespace (this=0x710920)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/DeleteSelectionCommand.cpp:575
#12 0x00007ffff31d6970 in WebCore::DeleteSelectionCommand::doApply (this=0x710920)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/DeleteSelectionCommand.cpp:850
#13 0x00007ffff31c26a0 in WebCore::CompositeEditCommand::applyCommandToComposite (this=0x87bd90, prpCommand=<incomplete type>)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/CompositeEditCommand.cpp:262
#14 0x00007ffff31c4b20 in WebCore::CompositeEditCommand::deleteSelection (this=0x87bd90, smartDelete=false, mergeBlocksAfterDelete=true, replace=true, 
    expandForSpecialElements=false, sanitizeMarkup=true) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/CompositeEditCommand.cpp:580
#15 0x00007ffff3225574 in WebCore::ReplaceSelectionCommand::doApply (this=0x87bd90)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/ReplaceSelectionCommand.cpp:943
#16 0x00007ffff31c2460 in WebCore::CompositeEditCommand::apply (this=0x87bd90)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/CompositeEditCommand.cpp:211
#17 0x00007ffff31c2260 in WebCore::applyCommand (command=<incomplete type>)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/CompositeEditCommand.cpp:170
#18 0x00007ffff31f71ff in WebCore::executeInsertFragment (frame=..., fragment=<incomplete type>)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/EditorCommand.cpp:195
#19 0x00007ffff31f88e2 in WebCore::executeInsertHTML (frame=..., value=...) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/EditorCommand.cpp:500
#20 0x00007ffff31fbceb in WebCore::Editor::Command::execute (this=0x7fffffffce30, parameter=..., triggeringEvent=0x0)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/EditorCommand.cpp:1713
#21 0x00007ffff30c41ba in WebCore::Document::execCommand (this=0x8505a0, commandName=..., userInterface=false, value=...)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/dom/Document.cpp:4092
#22 0x00007ffff3e907d5 in WebCore::jsDocumentPrototypeFunctionExecCommand (exec=0x7fffa35fcf20)
    at /home/reni/Data/REPOS/webkitnix/WebKitBuild/Debug/DerivedSources/WebCore/JSDocument.cpp:2705
#23 0x00007fffaa01d105 in ?? ()
#24 0x00007fffa35fcf70 in ?? ()
#25 0x00007ffff473ee34 in llint_op_call () from /home/reni/Data/REPOS/webkitnix/WebKitBuild/Debug/lib/libWebKitNix.so.0
#26 0x00007fffaa01d940 in ?? ()
#27 0x00000000007e4e98 in ?? ()
#28 0x0000000000611920 in ?? ()
#29 0x00007ffff05b69a0 in thread_context_stack () from /home/reni/Data/REPOS/webkitnix/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0
#30 0x00000000008cc9c0 in ?? ()
#31 0x00007ffff3526906 in WebCore::ResourceLoader::didReceiveBuffer (this=0x7fffa35fcf70, buffer=<incomplete type>, encodedDataLength=0)
---Type <return> to continue, or q <return> to quit---
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/loader/ResourceLoader.cpp:483
#32 0x00007fffffffcfc0 in ?? ()
#33 0x00007ffff450a0f3 in JSC::JITCode::execute (this=0x48ff837fb7e8c789, stack=0x48e0458d48d4ff41, callFrame=0xc78948da89480000, vm=0x1b9c8458b48e0)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/jit/JITCode.cpp:49
Backtrace stopped: previous frame inner to this frame (corrupt stack?)
Comment 1 Brent Fulgham 2016-08-03 13:21:51 PDT
This is reproducible under r204037.
Comment 2 Radar WebKit Bug Importer 2016-08-03 13:24:08 PDT
<rdar://problem/27684394>