Bug 174359 – ASSERTION FAILED: !simpleLineLayout() in WebCore::RenderText::containsRenderedCharacterOffset

• Status: NEW
• Component: Layout and Rendering

[Renata Hodovan]

Created attachment 315097 [details]
Test

Load the attached test with debug WebKitTestRunner:

Checked version: 6700d3c
OS: macOS Sierra (10.12.5)

<a>
    <script>
    document.designMode = 'on'
    document.execCommand ('SelectAll')
    document.execCommand ("InsertHTML",0,"<ul>")
    document.execCommand ("Indent")
    document.execCommand ("InsertHTML",true,"<p><table><tbody><tr><td>stats</td></tr></tbody></table></p>")
    document.execCommand ("InsertText",true,true)
    document.execCommand ("JustifyCenter")
    document.execCommand ("inserthorizontalrule")
    </script>
</a>

Backtrace:

ASSERTION FAILED: !simpleLineLayout()
WebKit/Source/WebCore/rendering/RenderText.cpp(1513) : bool WebCore::RenderText::containsRenderedCharacterOffset(unsigned int) const
1   0x12f412d11 WTFCrash
2   0x1168d5783 WebCore::RenderText::containsRenderedCharacterOffset(unsigned int) const
3   0x115e69cdd WebCore::Position::isRenderedCharacter() const
4   0x112f3bb18 WebCore::InsertParagraphSeparatorCommand::doApply()
5   0x111002d06 WebCore::CompositeEditCommand::applyCommandToComposite(WTF::Ref<WebCore::EditCommand>&&)
6   0x111004093 WebCore::CompositeEditCommand::insertParagraphSeparator(bool, bool)
7   0x116a1156f WebCore::ReplaceSelectionCommand::doApply()
8   0x111001d0a WebCore::CompositeEditCommand::apply()
9   0x111d5c831 WebCore::executeInsertFragment(WebCore::Frame&, WTF::Ref<WebCore::DocumentFragment>&&)
10  0x111d5cb42 WebCore::executeInsertNode(WebCore::Frame&, WTF::Ref<WebCore::Node>&&)
11  0x111d53cdc WebCore::executeInsertHorizontalRule(WebCore::Frame&, WebCore::Event*, WebCore::EditorCommandSource, WTF::String const&)
12  0x111d4f64c WebCore::Editor::Command::execute(WTF::String const&, WebCore::Event*) const
13  0x1119b07b2 WebCore::Document::execCommand(WTF::String const&, bool, WTF::String const&)
14  0x1136b2c19 WebCore::jsDocumentPrototypeFunctionExecCommandBody(JSC::ExecState*, WebCore::JSDocument*, JSC::ThrowScope&)
15  0x1136668ca long long WebCore::IDLOperation<WebCore::JSDocument>::call<&(WebCore::jsDocumentPrototypeFunctionExecCommandBody(JSC::ExecState*, WebCore::JSDocument*, JSC::ThrowScope&)), (WebCore::CastedThisErrorBehavior)0>(JSC::ExecState&, char const*)
16  0x1136664dc WebCore::jsDocumentPrototypeFunctionExecCommand(JSC::ExecState*)
17  0x5c18a3a01028
18  0x12e7cccf3 llint_entry
19  0x12e7c5357 vmEntryToJavaScript
20  0x12e1d2510 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*)
21  0x12e0df58b JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::ExecState*, JSC::JSObject*)
22  0x12cb78c29 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
23  0x12cb79141 JSC::profiledEvaluate(JSC::ExecState*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
24  0x116bb6b96 WebCore::JSMainThreadExecState::profiledEvaluate(JSC::ExecState*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
25  0x116bb640a WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&, WebCore::ExceptionDetails*)
26  0x116bb6e3a WebCore::ScriptController::evaluate(WebCore::ScriptSourceCode const&, WebCore::ExceptionDetails*)
27  0x116bf01b6 WebCore::ScriptElement::executeClassicScript(WebCore::ScriptSourceCode const&)
28  0x116bebcf9 WebCore::ScriptElement::prepareScript(WTF::TextPosition const&, WebCore::ScriptElement::LegacyTypeSupport)
29  0x1129cda71 WebCore::HTMLScriptRunner::runScript(WebCore::ScriptElement&, WTF::TextPosition const&)
30  0x1129cd4a5 WebCore::HTMLScriptRunner::execute(WTF::Ref<WebCore::ScriptElement>&&, WTF::TextPosition const&)
31  0x1127d44fd WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder()
ASAN:DEADLYSIGNAL
=================================================================
==68908==ERROR: AddressSanitizer: SEGV on unknown address 0x0000bbadbeef (pc 0x00012f412d49 bp 0x7fff58242b90 sp 0x7fff58242b80 T0)
    #0 0x12f412d48 in WTFCrash (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x3540d48)
    #1 0x1168d5782 in WebCore::RenderText::containsRenderedCharacterOffset(unsigned int) const (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x6186782)
    #2 0x115e69cdc in WebCore::Position::isRenderedCharacter() const (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x571acdc)
    #3 0x112f3bb17 in WebCore::InsertParagraphSeparatorCommand::doApply() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x27ecb17)
    #4 0x111002d05 in WebCore::CompositeEditCommand::applyCommandToComposite(WTF::Ref<WebCore::EditCommand>&&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x8b3d05)
    #5 0x111004092 in WebCore::CompositeEditCommand::insertParagraphSeparator(bool, bool) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x8b5092)
    #6 0x116a1156e in WebCore::ReplaceSelectionCommand::doApply() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x62c256e)
    #7 0x111001d09 in WebCore::CompositeEditCommand::apply() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x8b2d09)
    #8 0x111d5c830 in WebCore::executeInsertFragment(WebCore::Frame&, WTF::Ref<WebCore::DocumentFragment>&&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x160d830)
    #9 0x111d5cb41 in WebCore::executeInsertNode(WebCore::Frame&, WTF::Ref<WebCore::Node>&&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x160db41)
    #10 0x111d53cdb in WebCore::executeInsertHorizontalRule(WebCore::Frame&, WebCore::Event*, WebCore::EditorCommandSource, WTF::String const&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1604cdb)
    #11 0x111d4f64b in WebCore::Editor::Command::execute(WTF::String const&, WebCore::Event*) const (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x160064b)
    #12 0x1119b07b1 in WebCore::Document::execCommand(WTF::String const&, bool, WTF::String const&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x12617b1)
    #13 0x1136b2c18 in WebCore::jsDocumentPrototypeFunctionExecCommandBody(JSC::ExecState*, WebCore::JSDocument*, JSC::ThrowScope&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x2f63c18)
    #14 0x1136668c9 in long long WebCore::IDLOperation<WebCore::JSDocument>::call<&(WebCore::jsDocumentPrototypeFunctionExecCommandBody(JSC::ExecState*, WebCore::JSDocument*, JSC::ThrowScope&)), (WebCore::CastedThisErrorBehavior)0>(JSC::ExecState&, char const*) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x2f178c9)
    #15 0x1136664db in WebCore::jsDocumentPrototypeFunctionExecCommand(JSC::ExecState*) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x2f174db)
    #16 0x5c18a3a01027  (<unknown module>)
    #17 0x12e7cccf2 in llint_entry (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x28facf2)
    #18 0x12e7c5356 in vmEntryToJavaScript (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x28f3356)
    #19 0x12e1d250f in JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x230050f)
    #20 0x12e0df58a in JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::ExecState*, JSC::JSObject*) (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x220d58a)
    #21 0x12cb78c28 in JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0xca6c28)
    #22 0x12cb79140 in JSC::profiledEvaluate(JSC::ExecState*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0xca7140)
    #23 0x116bb6b95 in WebCore::JSMainThreadExecState::profiledEvaluate(JSC::ExecState*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x6467b95)
    #24 0x116bb6409 in WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&, WebCore::ExceptionDetails*) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x6467409)
    #25 0x116bb6e39 in WebCore::ScriptController::evaluate(WebCore::ScriptSourceCode const&, WebCore::ExceptionDetails*) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x6467e39)
    #26 0x116bf01b5 in WebCore::ScriptElement::executeClassicScript(WebCore::ScriptSourceCode const&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x64a11b5)
    #27 0x116bebcf8 in WebCore::ScriptElement::prepareScript(WTF::TextPosition const&, WebCore::ScriptElement::LegacyTypeSupport) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x649ccf8)
    #28 0x1129cda70 in WebCore::HTMLScriptRunner::runScript(WebCore::ScriptElement&, WTF::TextPosition const&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x227ea70)
    #29 0x1129cd4a4 in WebCore::HTMLScriptRunner::execute(WTF::Ref<WebCore::ScriptElement>&&, WTF::TextPosition const&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x227e4a4)
    #30 0x1127d44fc in WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x20854fc)
    #31 0x1127d54be in WebCore::HTMLDocumentParser::pumpTokenizerLoop(WebCore::HTMLDocumentParser::SynchronousMode, bool, WebCore::PumpSession&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x20864be)
    #32 0x1127d299a in WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x208399a)
    #33 0x1127d216f in WebCore::HTMLDocumentParser::pumpTokenizerIfPossible(WebCore::HTMLDocumentParser::SynchronousMode) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x208316f)
    #34 0x1127d7a2f in WebCore::HTMLDocumentParser::append(WTF::RefPtr<WTF::StringImpl>&&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x2088a2f)
    #35 0x11185d521 in WebCore::DecodedDataDocumentParser::flush(WebCore::DocumentWriter&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x110e521)
    #36 0x111b8b4f3 in WebCore::DocumentWriter::end() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x143c4f3)
    #37 0x111ad5756 in WebCore::DocumentLoader::finishedLoading() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1386756)
    #38 0x111ad5152 in WebCore::DocumentLoader::notifyFinished(WebCore::CachedResource&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1386152)
    #39 0x110d8d1e3 in WebCore::CachedResource::checkNotify() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x63e1e3)
    #40 0x110d8d873 in WebCore::CachedResource::finishLoading(WebCore::SharedBuffer*) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x63e873)
    #41 0x110d7e301 in WebCore::CachedRawResource::finishLoading(WebCore::SharedBuffer*) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x62f301)
    #42 0x1173b2211 in WebCore::SubresourceLoader::didFinishLoading(WebCore::NetworkLoadMetrics const&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x6c63211)
    #43 0x1098fe3fb in WebKit::WebResourceLoader::didFinishResourceLoad(WebCore::NetworkLoadMetrics const&) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x1f383fb)
    #44 0x10990b149 in void IPC::callMemberFunctionImpl<WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&), std::__1::tuple<WebCore::NetworkLoadMetrics>, 0ul>(WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&), std::__1::tuple<WebCore::NetworkLoadMetrics>&&, std::__1::integer_sequence<unsigned long, 0ul>) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x1f45149)
    #45 0x10990ad54 in void IPC::callMemberFunction<WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&), std::__1::tuple<WebCore::NetworkLoadMetrics>, std::__1::integer_sequence<unsigned long, 0ul> >(std::__1::tuple<WebCore::NetworkLoadMetrics>&&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x1f44d54)
    #46 0x109907df8 in void IPC::handleMessage<Messages::WebResourceLoader::DidFinishResourceLoad, WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)>(IPC::Decoder&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x1f41df8)
    #47 0x109905fba in WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage(IPC::Connection&, IPC::Decoder&) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x1f3ffba)
    #48 0x10827bfcc in WebKit::NetworkProcessConnection::didReceiveMessage(IPC::Connection&, IPC::Decoder&) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x8b5fcc)
    #49 0x107bd184a in IPC::Connection::dispatchMessage(IPC::Decoder&) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x20b84a)
    #50 0x107bb5ea4 in IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x1efea4)
    #51 0x107bd2535 in IPC::Connection::dispatchOneMessage() (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x20c535)
    #52 0x107c1113c in IPC::Connection::enqueueIncomingMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >)::$_14::operator()() (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x24b13c)
    #53 0x107c11068 in WTF::Function<void ()>::CallableWrapper<IPC::Connection::enqueueIncomingMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >)::$_14>::call() (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x24b068)
    #54 0x12f49f600 in WTF::Function<void ()>::operator()() const (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x35cd600)
    #55 0x12f4ee3a0 in WTF::RunLoop::performWork() (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x361c3a0)
    #56 0x12f4ef3d1 in WTF::RunLoop::performWork(void*) (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x361d3d1)
    #57 0x7fffabc81320 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0xa7320)
    #58 0x7fffabc6221c in __CFRunLoopDoSources0 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x8821c)
    #59 0x7fffabc61715 in __CFRunLoopRun (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x87715)
    #60 0x7fffabc61113 in CFRunLoopRunSpecific (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x87113)
    #61 0x7fffab1c2ebb in RunCurrentEventLoopInMode (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox+0x30ebb)
    #62 0x7fffab1c2cf0 in ReceiveNextEventCommon (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox+0x30cf0)
    #63 0x7fffab1c2b25 in _BlockUntilNextEventMatchingListInModeWithFilter (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox+0x30b25)
    #64 0x7fffa975ba53 in _DPSNextEvent (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x46a53)
    #65 0x7fffa9ed77ed in -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x7c27ed)
    #66 0x7fffa97503da in -[NSApplication run] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x3b3da)
    #67 0x7fffa971ae0d in NSApplicationMain (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x5e0d)
    #68 0x7fffc16348c6 in _xpc_objc_main (/usr/lib/system/libxpc.dylib+0x108c6)
    #69 0x7fffc16332e3 in xpc_main (/usr/lib/system/libxpc.dylib+0xf2e3)
    #70 0x1079b1f22 in main (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent.Development+0x100001f22)
    #71 0x7fffc13db234 in start (/usr/lib/system/libdyld.dylib+0x5234)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x3540d48) in WTFCrash
==68908==ABORTING
#CRASHED - com.apple.WebKit.WebContent.Development (pid 68908)
LEAK: 1 WebProcessPool
LEAK: 1 WebPageProxy