Bug 127339 - ASSERTION FAILED: s.anchorType() == Position::PositionIsAfterAnchor || !offsetIsBeforeLastNodeOffset(s.offsetInContainerNode(), s.containerNode()) in WebCore::ApplyStyleCommand::removeInlineStyle
Summary: ASSERTION FAILED: s.anchorType() == Position::PositionIsAfterAnchor || !offse...
Status: RESOLVED WORKSFORME
Alias: None
Product: WebKit
Classification: Unclassified
Component: HTML Editing (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks: 116980
  Show dependency tree / graph
 
Reported: 2014-01-21 05:02 PST by Renata Hodovan
Modified: 2016-08-03 13:48 PDT (History)
4 users (show)

See Also:

Attachments
Test case (239 bytes, text/html)
2014-01-21 05:02 PST, Renata Hodovan 		no flags Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Renata Hodovan 2014-01-21 05:02:31 PST 
Created attachment 221734 [details]
Test case

The failing test:

<div>foo
	<table>
		<iframe onload="document.designMode=&apos;on&apos;;
						document.execCommand(&apos;selectall&apos;);     
						document.execCommand(&apos;italic&apos;);
						document.body.innerHTML=&apos;PASS&apos;;
						">
</div>

Note that several dump messages are generated before we actually reach the crash.

The backtrace:

ASSERTION FAILED: s.anchorType() == Position::PositionIsAfterAnchor || !offsetIsBeforeLastNodeOffset(s.offsetInContainerNode(), s.containerNode())
/home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/ApplyStyleCommand.cpp(1154) : void WebCore::ApplyStyleCommand::removeInlineStyle(WebCore::EditingStyle*, const WebCore::Position&, const WebCore::Position&)
1   0x7ffff5c172a1 WTFCrash
2   0x7ffff0a6f6fd WebCore::ApplyStyleCommand::removeInlineStyle(WebCore::EditingStyle*, WebCore::Position const&, WebCore::Position const&)
3   0x7ffff0a6c4ca WebCore::ApplyStyleCommand::applyInlineStyle(WebCore::EditingStyle*)
4   0x7ffff0a69a37 WebCore::ApplyStyleCommand::doApply()
5   0x7ffff0a78c54 WebCore::CompositeEditCommand::apply()
6   0x7ffff0a78a4c WebCore::applyCommand(WTF::PassRefPtr<WebCore::CompositeEditCommand>)
7   0x7ffff0a9c3ea WebCore::Editor::applyStyle(WebCore::StyleProperties*, WebCore::EditAction)
8   0x7ffff0aaccd0
9   0x7ffff0aad2df
10  0x7ffff0ab0ad6
11  0x7ffff0ab1f22 WebCore::Editor::Command::execute(WTF::String const&, WebCore::Event*) const
12  0x7ffff0976ab2 WebCore::Document::execCommand(WTF::String const&, bool, WTF::String const&)
13  0x7ffff1812910 WebCore::jsDocumentPrototypeFunctionExecCommand(JSC::ExecState*)
14  0x7fff9d5640e5

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff5c172a6 in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:333
333	    *(int *)(uintptr_t)0xbbadbeef = 0;
(gdb) bt
#0  0x00007ffff5c172a6 in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:333
#1  0x00007ffff0a6f6fd in WebCore::ApplyStyleCommand::removeInlineStyle (this=0x32c6f20, style=0x32ca0e0, start=..., end=...)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/ApplyStyleCommand.cpp:1154
#2  0x00007ffff0a6c4ca in WebCore::ApplyStyleCommand::applyInlineStyle (this=0x32c6f20, style=0x32ca0e0)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/ApplyStyleCommand.cpp:637
#3  0x00007ffff0a69a37 in WebCore::ApplyStyleCommand::doApply (this=0x32c6f20)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/ApplyStyleCommand.cpp:220
#4  0x00007ffff0a78c54 in WebCore::CompositeEditCommand::apply (this=0x32c6f20)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/CompositeEditCommand.cpp:227
#5  0x00007ffff0a78a4c in WebCore::applyCommand (command=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/CompositeEditCommand.cpp:182
#6  0x00007ffff0a9c3ea in WebCore::Editor::applyStyle (this=0x8de210, style=0x32bb750, editingAction=WebCore::EditActionUnspecified)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/Editor.cpp:982
#7  0x00007ffff0aaccd0 in WebCore::applyCommandToFrame (frame=..., source=WebCore::CommandFromDOM, action=WebCore::EditActionItalics, style=0x32bb750)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/EditorCommand.cpp:110
#8  0x00007ffff0aad2df in WebCore::executeToggleStyle (frame=..., source=WebCore::CommandFromDOM, action=WebCore::EditActionItalics, 
    propertyID=WebCore::CSSPropertyFontStyle, offValue=0x7ffff208a14c "normal", onValue=0x7ffff208a153 "italic")
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/EditorCommand.cpp:171
#9  0x00007ffff0ab0ad6 in WebCore::executeToggleItalic (frame=..., source=WebCore::CommandFromDOM)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/EditorCommand.cpp:1119
#10 0x00007ffff0ab1f22 in WebCore::Editor::Command::execute (this=0x7fffff823d90, parameter=..., triggeringEvent=0x0)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/EditorCommand.cpp:1740
#11 0x00007ffff0976ab2 in WebCore::Document::execCommand (this=0x11c7e40, commandName=..., userInterface=false, value=...)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Document.cpp:4220
#12 0x00007ffff1812910 in WebCore::jsDocumentPrototypeFunctionExecCommand (exec=0x7fff93d6c680)
    at /home/reni/Data/REPOS/webkit_sec/WebKitBuild/Debug/DerivedSources/WebCore/JSDocument.cpp:3369
#13 0x00007fff9d5640e5 in ?? ()
#14 0x00007fff93d6c6d0 in ?? ()
#15 0x00007fffdd563a65 in ?? ()
#16 0x00007fffdd5638a0 in ?? ()
#17 0x0000000001141730 in ?? ()
#18 0x0000000000000001 in ?? ()
#19 0x0000000000000001 in ?? ()
#20 0x0000000001109320 in ?? ()
#21 0x0000000000000000 in ?? ()
Comment 1 Brent Fulgham 2016-08-03 13:48:22 PDT 
This issue no longer occurs under GuardMalloc or ASAN as of r204037. If you believe there is still a bug, please reopen this issue with a revised test case.