Bug 175923 – [iOS WK2] editing/execCommand/forward-delete-read-write-canvas.html hits a debug assertion in Position::Position

• Status: NEW
• Component: HTML Editing

[Wenson Hsieh]

Test case: load the following HTML:

```
<code style="color: green">PASS</code>
<canvas style="-webkit-user-modify: read-write"><input id="input"></canvas>
<script>
if (window.testRunner)
    testRunner.dumpAsText();
input.focus();
input.remove();
document.execCommand("ForwardDelete");
</script>
```

...and observe an assertion like this:

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.JavaScriptCore      	0x0000000109518c27 WTFCrash + 39 (Assertions.cpp:278)
1   com.apple.WebCore             	0x0000000112e51747 WebCore::Position::Position(WebCore::Node*, int, WebCore::Position::AnchorType) + 183 (Position.cpp:130)
2   com.apple.WebCore             	0x0000000112e51819 WebCore::Position::Position(WebCore::Node*, int, WebCore::Position::AnchorType) + 41 (Position.cpp:133)
3   com.apple.WebCore             	0x0000000110cd62bc WebCore::positionInParentBeforeNode(WebCore::Node const*) + 124 (Position.h:266)
4   com.apple.WebCore             	0x0000000111570f2e WebCore::updatePositionForNodeRemoval(WebCore::Position&, WebCore::Node&) + 270 (Editing.cpp:960)
5   com.apple.WebCore             	0x00000001117f9dba WebCore::FrameSelection::respondToNodeModification(WebCore::Node&, bool, bool, bool, bool) + 170 (FrameSelection.cpp:472)
6   com.apple.WebCore             	0x00000001117f9cdd WebCore::FrameSelection::nodeWillBeRemoved(WebCore::Node&) + 349 (FrameSelection.cpp:458)
7   com.apple.WebCore             	0x000000011141b3a8 WebCore::Document::nodeWillBeRemoved(WebCore::Node&) + 584 (Document.cpp:4075)
8   com.apple.WebCore             	0x000000011103ece8 WebCore::ContainerNode::removeChild(WebCore::Node&) + 456 (ContainerNode.cpp:544)
9   com.apple.WebCore             	0x0000000112d2a4ad WebCore::Node::remove() + 109 (Node.cpp:565)
10  com.apple.WebCore             	0x000000011215a0cd WebCore::jsElementPrototypeFunctionRemoveBody(JSC::ExecState*, WebCore::JSElement*, JSC::ThrowScope&) + 77 (JSElement.cpp:2641)
11  com.apple.WebCore             	0x0000000112152717 long long WebCore::IDLOperation<WebCore::JSElement>::call<&(WebCore::jsElementPrototypeFunctionRemoveBody(JSC::ExecState*, WebCore::JSElement*, JSC::ThrowScope&)), (WebCore::CastedThisErrorBehavior)0>(JSC::ExecState&, char const*) + 615 (JSDOMOperation.h:53)
12  com.apple.WebCore             	0x000000011214595c WebCore::jsElementPrototypeFunctionRemove(JSC::ExecState*) + 28 (JSElement.cpp:2647)
13  ???                           	0x00005c9ab8001028 0 + 101819581730856
14  com.apple.JavaScriptCore      	0x00000001090853d6 llint_entry + 31248
15  com.apple.JavaScriptCore      	0x000000010907d7a7 vmEntryToJavaScript + 343
16  com.apple.JavaScriptCore      	0x0000000108e4bc21 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 353 (JITCode.cpp:81)
17  com.apple.JavaScriptCore      	0x0000000108df8853 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::ExecState*, JSC::JSObject*) + 5283 (Interpreter.cpp:912)
18  com.apple.JavaScriptCore      	0x0000000108648368 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) + 472 (Completion.cpp:102)
19  com.apple.JavaScriptCore      	0x00000001086484b0 JSC::profiledEvaluate(JSC::ExecState*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) + 80 (Completion.cpp:117)


Discovered while writing a test case for https://bugs.webkit.org/show_bug.cgi?id=175914.

[Wenson Hsieh]

Retitling and repurposing -- looks like WK2 iOS hits a debug assertion when creating a Position anyways in platform-specific code. This looks related to the assertion seen in the original test case below.

[Alexey Proskuryakov]

*** Bug 175939 has been marked as a duplicate of this bug. ***

[Alexey Proskuryakov]

Ryan skipped the test in https://trac.webkit.org/r221140

ASSERTION FAILED: !((anchorType == PositionIsBeforeChildren || anchorType == PositionIsAfterChildren) && (is<Text>(*m_anchorNode) || editingIgnoresContent(*m_anchorNode)))