Created attachment 221736 [details] Test case The test: foo <div contenteditable="false"> <span contenteditable="true"></span> </div> <iframe onload="document.designMode='on'; document.execCommand('selectall'); document.execCommand('italic');"> The backtrace: ASSERTION FAILED: m_refChild->parentNode()->hasEditableStyle() || !m_refChild->parentNode()->renderer() /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/InsertNodeBeforeCommand.cpp(48) : WebCore::InsertNodeBeforeCommand::InsertNodeBeforeCommand(WTF::PassRefPtr<WebCore::Node>, WTF::PassRefPtr<WebCore::Node>, WebCore::ShouldAssumeContentIsAlwaysEditable) 1 0x7ffff5c172a1 WTFCrash 2 0x7ffff0ac7ca4 WebCore::InsertNodeBeforeCommand::InsertNodeBeforeCommand(WTF::PassRefPtr<WebCore::Node>, WTF::PassRefPtr<WebCore::Node>, WebCore::ShouldAssumeContentIsAlwaysEditable) 3 0x7ffff0a817f3 WebCore::InsertNodeBeforeCommand::create(WTF::PassRefPtr<WebCore::Node>, WTF::PassRefPtr<WebCore::Node>, WebCore::ShouldAssumeContentIsAlwaysEditable) 4 0x7ffff0a79470 WebCore::CompositeEditCommand::insertNodeBefore(WTF::PassRefPtr<WebCore::Node>, WTF::PassRefPtr<WebCore::Node>, WebCore::ShouldAssumeContentIsAlwaysEditable) 5 0x7ffff0a70b51 WebCore::ApplyStyleCommand::surroundNodeRangeWithElement(WTF::PassRefPtr<WebCore::Node>, WTF::PassRefPtr<WebCore::Node>, WTF::PassRefPtr<WebCore::Element>) 6 0x7ffff0a72023 WebCore::ApplyStyleCommand::applyInlineStyleChange(WTF::PassRefPtr<WebCore::Node>, WTF::PassRefPtr<WebCore::Node>, WebCore::StyleChange&, WebCore::ApplyStyleCommand::EAddStyledElement) 7 0x7ffff0a6d7a7 WebCore::ApplyStyleCommand::applyInlineStyleToNodeRange(WebCore::EditingStyle*, WTF::PassRefPtr<WebCore::Node>, WTF::PassRefPtr<WebCore::Node>) 8 0x7ffff0a6cd0a WebCore::ApplyStyleCommand::fixRangeAndApplyInlineStyle(WebCore::EditingStyle*, WebCore::Position const&, WebCore::Position const&) 9 0x7ffff0a6c945 WebCore::ApplyStyleCommand::applyInlineStyle(WebCore::EditingStyle*) 10 0x7ffff0a69a37 WebCore::ApplyStyleCommand::doApply() 11 0x7ffff0a78c54 WebCore::CompositeEditCommand::apply() 12 0x7ffff0a78a4c WebCore::applyCommand(WTF::PassRefPtr<WebCore::CompositeEditCommand>) 13 0x7ffff0a9c3ea WebCore::Editor::applyStyle(WebCore::StyleProperties*, WebCore::EditAction) 14 0x7ffff0aaccd0 15 0x7ffff0aad2df 16 0x7ffff0ab0ad6 17 0x7ffff0ab1f22 WebCore::Editor::Command::execute(WTF::String const&, WebCore::Event*) const 18 0x7ffff0976ab2 WebCore::Document::execCommand(WTF::String const&, bool, WTF::String const&) 19 0x7ffff1812910 WebCore::jsDocumentPrototypeFunctionExecCommand(JSC::ExecState*) 20 0x7fff9d5640e5 Program received signal SIGSEGV, Segmentation fault. 0x00007ffff5c172a6 in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:333 333 *(int *)(uintptr_t)0xbbadbeef = 0; (gdb) bt #0 0x00007ffff5c172a6 in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:333 #1 0x00007ffff0ac7ca4 in WebCore::InsertNodeBeforeCommand::InsertNodeBeforeCommand (this=0x11feeb0, insertChild=..., refChild=..., shouldAssumeContentIsAlwaysEditable=WebCore::DoNotAssumeContentIsAlwaysEditable) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/InsertNodeBeforeCommand.cpp:48 #2 0x00007ffff0a817f3 in WebCore::InsertNodeBeforeCommand::create (childToInsert=..., childToInsertBefore=..., shouldAssumeContentIsAlwaysEditable=WebCore::DoNotAssumeContentIsAlwaysEditable) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/InsertNodeBeforeCommand.h:38 #3 0x00007ffff0a79470 in WebCore::CompositeEditCommand::insertNodeBefore (this=0x121c040, insertChild=..., refChild=..., shouldAssumeContentIsAlwaysEditable=WebCore::DoNotAssumeContentIsAlwaysEditable) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/CompositeEditCommand.cpp:345 #4 0x00007ffff0a70b51 in WebCore::ApplyStyleCommand::surroundNodeRangeWithElement (this=0x121c040, passedStartNode=..., endNode=..., elementToInsert=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/ApplyStyleCommand.cpp:1355 #5 0x00007ffff0a72023 in WebCore::ApplyStyleCommand::applyInlineStyleChange (this=0x121c040, passedStart=..., passedEnd=..., styleChange=..., addStyledElement=WebCore::ApplyStyleCommand::AddStyledElement) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/ApplyStyleCommand.cpp:1498 #6 0x00007ffff0a6d7a7 in WebCore::ApplyStyleCommand::applyInlineStyleToNodeRange (this=0x121c040, style=0x122ceb0, startNode=..., pastEndNode=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/ApplyStyleCommand.cpp:832 #7 0x00007ffff0a6cd0a in WebCore::ApplyStyleCommand::fixRangeAndApplyInlineStyle (this=0x121c040, style=0x122ceb0, start=..., end=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/ApplyStyleCommand.cpp:717 #8 0x00007ffff0a6c945 in WebCore::ApplyStyleCommand::applyInlineStyle (this=0x121c040, style=0x122ceb0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/ApplyStyleCommand.cpp:680 #9 0x00007ffff0a69a37 in WebCore::ApplyStyleCommand::doApply (this=0x121c040) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/ApplyStyleCommand.cpp:220 #10 0x00007ffff0a78c54 in WebCore::CompositeEditCommand::apply (this=0x121c040) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/CompositeEditCommand.cpp:227 #11 0x00007ffff0a78a4c in WebCore::applyCommand (command=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/CompositeEditCommand.cpp:182 #12 0x00007ffff0a9c3ea in WebCore::Editor::applyStyle (this=0x7c8620, style=0x11f9ff0, editingAction=WebCore::EditActionUnspecified) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/Editor.cpp:982 #13 0x00007ffff0aaccd0 in WebCore::applyCommandToFrame (frame=..., source=WebCore::CommandFromDOM, action=WebCore::EditActionItalics, style=0x11f9ff0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/EditorCommand.cpp:110 #14 0x00007ffff0aad2df in WebCore::executeToggleStyle (frame=..., source=WebCore::CommandFromDOM, action=WebCore::EditActionItalics, propertyID=WebCore::CSSPropertyFontStyle, offValue=0x7ffff208a14c "normal", onValue=0x7ffff208a153 "italic") at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/EditorCommand.cpp:171 #15 0x00007ffff0ab0ad6 in WebCore::executeToggleItalic (frame=..., source=WebCore::CommandFromDOM) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/EditorCommand.cpp:1119 #16 0x00007ffff0ab1f22 in WebCore::Editor::Command::execute (this=0x7fffffff9ad0, parameter=..., triggeringEvent=0x0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/EditorCommand.cpp:1740 #17 0x00007ffff0976ab2 in WebCore::Document::execCommand (this=0x11c7f10, commandName=..., userInterface=false, value=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Document.cpp:4220 #18 0x00007ffff1812910 in WebCore::jsDocumentPrototypeFunctionExecCommand (exec=0x7fff93d8bf40) at /home/reni/Data/REPOS/webkit_sec/WebKitBuild/Debug/DerivedSources/WebCore/JSDocument.cpp:3369 #19 0x00007fff9d5640e5 in ?? () #20 0x00007fff93d8bf90 in ?? () #21 0x00007ffff5c05421 in llint_op_call () from /home/reni/Data/REPOS/webkit_sec/WebKitBuild/Debug/lib/libjavascriptcore_efl.so.0 #22 0x00007fff9d564900 in ?? () #23 0x00000000011416d0 in ?? () #24 0x0000000000000001 in ?? () #25 0x0000000000000001 in ?? () #26 0x0000000000770670 in ?? () #27 0x0000000000000000 in ?? ()
It's still valid on ToT WebKit. Validated on r197952 both with Mac and EFL builds.
This still occurs under r204037.
<rdar://problem/27685023>