Test: <head> <script> function func() { document.designMode = 'on'; document.execCommand("selectAll", false, null); document.execCommand("justifyFull", true , null); } </script> <style> * { text-transform:uppercase; } </style> </head> ʼn <body onload='func()'></body>
Backtrace: #0 in WTFCrash () at WebKit/Source/WTF/wtf/Assertions.cpp:329 #1 in WebCore::NoExceptionAssertionChecker::~NoExceptionAssertionChecker (this=0x7fffffffc130, __in_chrg=<optimized out>) at WebKit/Source/WebCore/dom/ExceptionCodePlaceholder.cpp:47 #2 in WebCore::Range::Range (this=0x896f70, ownerDocument=..., startContainer=..., startOffset=0, endContainer=..., endOffset=3) at WebKit/Source/WebCore/dom/Range.cpp:94 #3 in WebCore::Range::create (ownerDocument=..., startContainer=..., startOffset=0, endContainer=..., endOffset=3) at WebKit/Source/WebCore/dom/Range.cpp:99 #4 in WebCore::TextIterator::range (this=0x7fffffffc320) at WebKit/Source/WebCore/editing/TextIterator.cpp:1102 #5 in WebCore::TextIterator::rangeFromLocationAndLength (scope=0x765d40, rangeLocation=0, rangeLength=0, forSelectionPreservation=true) at WebKit/Source/WebCore/editing/TextIterator.cpp:2400 #6 in WebCore::ApplyStyleCommand::applyBlockStyle (this=0x9a8e70, style=0x9a8fa0) at WebKit/Source/WebCore/editing/ApplyStyleCommand.cpp:302 #7 in WebCore::ApplyStyleCommand::doApply (this=0x9a8e70) at WebKit/Source/WebCore/editing/ApplyStyleCommand.cpp:224 #8 in WebCore::CompositeEditCommand::apply (this=0x9a8e70) at WebKit/Source/WebCore/editing/CompositeEditCommand.cpp:227 #9 in WebCore::applyCommand (command=...) at WebKit/Source/WebCore/editing/CompositeEditCommand.cpp:182 #10 WebCore::Editor::applyParagraphStyle (this=0x727d50, style=0x891230, editingAction=WebCore::EditActionUnspecified) at WebKit/Source/WebCore/editing/Editor.cpp:990 #11 in WebCore::executeApplyParagraphStyle (frame=..., source=WebCore::CommandFromDOMWithUserInterface, action=WebCore::EditActionJustify, propertyID=WebCore::CSSPropertyTextAlign, propertyValue=...) at WebKit/Source/WebCore/editing/EditorCommand.cpp:185 #12 in WebCore::executeJustifyFull (frame=..., source=WebCore::CommandFromDOMWithUserInterface) at WebKit/Source/WebCore/editing/EditorCommand.cpp:586 #13 in WebCore::Editor::Command::execute (this=0x7fffffffc800, parameter=..., triggeringEvent=0x0) at WebKit/Source/WebCore/editing/EditorCommand.cpp:1740 #14 in WebCore::Document::execCommand (this=0x765d40, commandName=..., userInterface=true, value=...) at WebKit/Source/WebCore/dom/Document.cpp:4279 #15 in WebCore::jsDocumentPrototypeFunctionExecCommand (exec=0x7fffffffc8f0) at WebKit/WebKitBuild/Debug/DerivedSources/WebCore/JSDocument.cpp:4526 #16 in ?? () #17 in ?? () #18 in llint_entry () from WebKit/WebKitBuild/Debug/lib/libjavascriptcore_efl.so.0
(In reply to comment #1) > #3 in WebCore::Range::create (ownerDocument=..., startContainer=..., startOffset=0, endContainer=..., endOffset=3) at WebKit/Source/WebCore/dom/Range.cpp:99 Sure would be nice to see what these pointers are.
This reproduces under r204037.
<rdar://problem/27701846>