Load the attached test with debug WebKitTestRunner: Checked version: 217d599 OS: Darwin-16.3.0-x86_64-i386-64bit <head><script>window.onload = function() { document.execCommand ('selectAll') document.designMode = 'on' document.execCommand ('indent') }</script><style> & { & } * { display: table-cell; </style></a><a><hr></a></a> Backtrace: ASSERTION FAILED: node->parentNode() WebKit/Source/WebCore/dom/Position.h(269) : WebCore::Position WebCore::positionInParentAfterNode(const WebCore::Node *) 1 0x112a41111 WTFCrash 2 0x1172b6273 WebCore::positionInParentAfterNode(WebCore::Node const*) 3 0x1197b271e WebCore::IndentOutdentCommand::indentIntoBlockquote(WebCore::Position const&, WebCore::Position const&, WTF::RefPtr<WebCore::Element>&) 4 0x1197b446c WebCore::IndentOutdentCommand::formatRange(WebCore::Position const&, WebCore::Position const&, WebCore::Position const&, WTF::RefPtr<WebCore::Element>&) 5 0x1174803d1 WebCore::ApplyBlockElementCommand::formatSelection(WebCore::VisiblePosition const&, WebCore::VisiblePosition const&) 6 0x1197b43df WebCore::IndentOutdentCommand::formatSelection(WebCore::VisiblePosition const&, WebCore::VisiblePosition const&) 7 0x11747ef98 WebCore::ApplyBlockElementCommand::doApply() 8 0x117acd36a WebCore::CompositeEditCommand::apply() 9 0x117accf81 WebCore::applyCommand(WTF::PassRefPtr<WebCore::CompositeEditCommand>) 10 0x11870821f WebCore::executeIndent(WebCore::Frame&, WebCore::Event*, WebCore::EditorCommandSource, WTF::String const&) 11 0x118703f0c WebCore::Editor::Command::execute(WTF::String const&, WebCore::Event*) const 12 0x1183970d2 WebCore::Document::execCommand(WTF::String const&, bool, WTF::String const&) 13 0x119fb2a4b WebCore::jsDocumentPrototypeFunctionExecCommandCaller(JSC::ExecState*, WebCore::JSDocument*, JSC::ThrowScope&) 14 0x119f63ab5 long long WebCore::BindingCaller<WebCore::JSDocument>::callOperation<&(WebCore::jsDocumentPrototypeFunctionExecCommandCaller(JSC::ExecState*, WebCore::JSDocument*, JSC::ThrowScope&)), (WebCore::CastedThisErrorBehavior)0>(JSC::ExecState*, char const*) 15 0x119f6365a WebCore::jsDocumentPrototypeFunctionExecCommand(JSC::ExecState*) 16 0x5e15b6201028 17 0x111ee56a5 llint_entry 18 0x111eddf6e vmEntryToJavaScript 19 0x11195f77e JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) 20 0x11188cb91 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) 21 0x11026043b JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) 22 0x1102609b8 JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) 23 0x11026152e JSC::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) 24 0x119d03af1 WebCore::JSMainThreadExecState::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) 25 0x11a4a756c WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext*, WebCore::Event*) 26 0x11882db3a WebCore::EventTarget::fireEventListeners(WebCore::Event&, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener>, 1ul, WTF::CrashOnOverflow, 16ul>) 27 0x11882d39b WebCore::EventTarget::fireEventListeners(WebCore::Event&) 28 0x1185f0b5b WebCore::DOMWindow::dispatchEvent(WebCore::Event&, WebCore::EventTarget*) 29 0x11860ea55 WebCore::DOMWindow::dispatchLoadEvent() 30 0x118377b92 WebCore::Document::dispatchWindowLoadEvent() 31 0x11836b44d WebCore::Document::implicitClose() ASAN:DEADLYSIGNAL ================================================================= ==19163==ERROR: AddressSanitizer: SEGV on unknown address 0x0000bbadbeef (pc 0x000112a41149 bp 0x7fff59f44f80 sp 0x7fff59f44f70 T0) #0 0x112a41148 in WTFCrash (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x32d7148) #1 0x1172b6272 in WebCore::positionInParentAfterNode(WebCore::Node const*) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0xc8272) #2 0x1197b271d in WebCore::IndentOutdentCommand::indentIntoBlockquote(WebCore::Position const&, WebCore::Position const&, WTF::RefPtr<WebCore::Element>&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x25c471d) #3 0x1197b446b in WebCore::IndentOutdentCommand::formatRange(WebCore::Position const&, WebCore::Position const&, WebCore::Position const&, WTF::RefPtr<WebCore::Element>&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x25c646b) #4 0x1174803d0 in WebCore::ApplyBlockElementCommand::formatSelection(WebCore::VisiblePosition const&, WebCore::VisiblePosition const&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x2923d0) #5 0x1197b43de in WebCore::IndentOutdentCommand::formatSelection(WebCore::VisiblePosition const&, WebCore::VisiblePosition const&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x25c63de) #6 0x11747ef97 in WebCore::ApplyBlockElementCommand::doApply() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x290f97) #7 0x117acd369 in WebCore::CompositeEditCommand::apply() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x8df369) #8 0x117accf80 in WebCore::applyCommand(WTF::PassRefPtr<WebCore::CompositeEditCommand>) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x8def80) #9 0x11870821e in WebCore::executeIndent(WebCore::Frame&, WebCore::Event*, WebCore::EditorCommandSource, WTF::String const&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x151a21e) #10 0x118703f0b in WebCore::Editor::Command::execute(WTF::String const&, WebCore::Event*) const (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1515f0b) #11 0x1183970d1 in WebCore::Document::execCommand(WTF::String const&, bool, WTF::String const&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x11a90d1) #12 0x119fb2a4a in WebCore::jsDocumentPrototypeFunctionExecCommandCaller(JSC::ExecState*, WebCore::JSDocument*, JSC::ThrowScope&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x2dc4a4a) #13 0x119f63ab4 in long long WebCore::BindingCaller<WebCore::JSDocument>::callOperation<&(WebCore::jsDocumentPrototypeFunctionExecCommandCaller(JSC::ExecState*, WebCore::JSDocument*, JSC::ThrowScope&)), (WebCore::CastedThisErrorBehavior)0>(JSC::ExecState*, char const*) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x2d75ab4) #14 0x119f63659 in WebCore::jsDocumentPrototypeFunctionExecCommand(JSC::ExecState*) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x2d75659) #15 0x5e15b6201027 (<unknown module>) #16 0x111ee56a4 in llint_entry (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x277b6a4) #17 0x111eddf6d in vmEntryToJavaScript (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x2773f6d) #18 0x11195f77d in JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x21f577d) #19 0x11188cb90 in JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x2122b90) #20 0x11026043a in JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0xaf643a) #21 0x1102609b7 in JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0xaf69b7) #22 0x11026152d in JSC::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0xaf752d) #23 0x119d03af0 in WebCore::JSMainThreadExecState::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x2b15af0) #24 0x11a4a756b in WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext*, WebCore::Event*) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x32b956b) #25 0x11882db39 in WebCore::EventTarget::fireEventListeners(WebCore::Event&, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener>, 1ul, WTF::CrashOnOverflow, 16ul>) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x163fb39) #26 0x11882d39a in WebCore::EventTarget::fireEventListeners(WebCore::Event&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x163f39a) #27 0x1185f0b5a in WebCore::DOMWindow::dispatchEvent(WebCore::Event&, WebCore::EventTarget*) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1402b5a) #28 0x11860ea54 in WebCore::DOMWindow::dispatchLoadEvent() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1420a54) #29 0x118377b91 in WebCore::Document::dispatchWindowLoadEvent() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1189b91) #30 0x11836b44c in WebCore::Document::implicitClose() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x117d44c) #31 0x118cbb122 in WebCore::FrameLoader::checkCallImplicitClose() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1acd122) #32 0x118cba91b in WebCore::FrameLoader::checkCompleted() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1acc91b) #33 0x118cb6c96 in WebCore::FrameLoader::finishedParsing() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1ac8c96) #34 0x11839b4fb in WebCore::Document::finishedParsing() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x11ad4fb) #35 0x11909ead5 in WebCore::HTMLConstructionSite::finishedParsing() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1eb0ad5) #36 0x1193af607 in WebCore::HTMLTreeBuilder::finished() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x21c1607) #37 0x11911888b in WebCore::HTMLDocumentParser::end() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1f2a88b) #38 0x1191131b6 in WebCore::HTMLDocumentParser::attemptToRunDeferredScriptsAndEnd() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1f251b6) #39 0x119112d6d in WebCore::HTMLDocumentParser::prepareToStopParsing() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1f24d6d) #40 0x1191189ab in WebCore::HTMLDocumentParser::attemptToEnd() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1f2a9ab) #41 0x119118ae3 in WebCore::HTMLDocumentParser::finish() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1f2aae3) #42 0x11856d0cf in WebCore::DocumentWriter::end() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x137f0cf) #43 0x1184b4306 in WebCore::DocumentLoader::finishedLoading(double) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x12c6306) #44 0x1184b3dda in WebCore::DocumentLoader::notifyFinished(WebCore::CachedResource&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x12c5dda) #45 0x117820d73 in WebCore::CachedResource::checkNotify() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x632d73) #46 0x117821403 in WebCore::CachedResource::finishLoading(WebCore::SharedBuffer*) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x633403) #47 0x117813364 in WebCore::CachedRawResource::finishLoading(WebCore::SharedBuffer*) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x625364) #48 0x11d90302e in WebCore::SubresourceLoader::didFinishLoading(double) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x671502e) #49 0x107a37509 in WebKit::WebResourceLoader::didFinishResourceLoad(double) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x1d69509) #50 0x107a46c5e in void IPC::callMemberFunctionImpl<WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(double), std::__1::tuple<double>, 0ul>(WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(double), std::__1::tuple<double>&&, std::__1::integer_sequence<unsigned long, 0ul>) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x1d78c5e) #51 0x107a46904 in void IPC::callMemberFunction<WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(double), std::__1::tuple<double>, std::__1::integer_sequence<unsigned long, 0ul> >(std::__1::tuple<double>&&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(double)) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x1d78904) #52 0x107a43e20 in void IPC::handleMessage<Messages::WebResourceLoader::DidFinishResourceLoad, WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(double)>(IPC::Decoder&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(double)) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x1d75e20) #53 0x107a421e0 in WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage(IPC::Connection&, IPC::Decoder&) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x1d741e0) #54 0x106577cc9 in WebKit::NetworkProcessConnection::didReceiveMessage(IPC::Connection&, IPC::Decoder&) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x8a9cc9) #55 0x105eb73ba in IPC::Connection::dispatchMessage(IPC::Decoder&) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x1e93ba) #56 0x105e9b9f4 in IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x1cd9f4) #57 0x105eb80a5 in IPC::Connection::dispatchOneMessage() (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x1ea0a5) #58 0x105ef8d4c in IPC::Connection::enqueueIncomingMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >)::$_14::operator()() (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x22ad4c) #59 0x105ef8c78 in WTF::Function<void ()>::CallableWrapper<IPC::Connection::enqueueIncomingMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >)::$_14>::call() (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x22ac78) #60 0x112abda10 in WTF::Function<void ()>::operator()() const (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x3353a10) #61 0x112b01ea6 in WTF::RunLoop::performWork() (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x3397ea6) #62 0x112b02ff1 in WTF::RunLoop::performWork(void*) (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x3398ff1) #63 0x7fffb8faa980 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0xa7980) #64 0x7fffb8f8ba7c in __CFRunLoopDoSources0 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x88a7c) #65 0x7fffb8f8af75 in __CFRunLoopRun (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x87f75) #66 0x7fffb8f8a973 in CFRunLoopRunSpecific (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x87973) #67 0x7fffb8516acb in RunCurrentEventLoopInMode (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox+0x30acb) #68 0x7fffb8516900 in ReceiveNextEventCommon (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox+0x30900) #69 0x7fffb8516735 in _BlockUntilNextEventMatchingListInModeWithFilter (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox+0x30735) #70 0x7fffb6abcae3 in _DPSNextEvent (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x46ae3) #71 0x7fffb723721e in -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x7c121e) #72 0x7fffb6ab1464 in -[NSApplication run] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x3b464) #73 0x7fffb6a7bd7f in NSApplicationMain (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x5d7f) #74 0x7fffce7478c6 in _xpc_objc_main (/usr/lib/system/libxpc.dylib+0x108c6) #75 0x7fffce7462e3 in xpc_main (/usr/lib/system/libxpc.dylib+0xf2e3) #76 0x105cb40a3 in main (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent.Development+0x1000020a3) #77 0x7fffce4e3254 in start (/usr/lib/system/libdyld.dylib+0x5254) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x32d7148) in WTFCrash ==19163==ABORTING #CRASHED - com.apple.WebKit.WebContent.Development (pid 19163)
Created attachment 298314 [details] Test
Weird coincidence, I was just about to start hacking on IndentOutdentCommand. I guess I'll look at this too. Is this a regression?
In a somewhat bizarre turn of events, the <script> tag's contents are getting put in a blockquote. And the style, too.
Created attachment 298405 [details] simpler reduction
insertNodeBefore(<blockquote>, <html>), yep, that's gonna go well.
I am not able to assert “simpler reduction” testcase using WebKit debug build in mini-browser based of 259136@main. Can we close this now?