Bug 204401 – [GTK] Web Process crashes when making a text selection

• Status: RESOLVED
• Resolution: DUPLICATE
• Component: WebKitGTK

[Sergio Villar Senin]

I get a consistent crash selecting text using epy with 2.26.2. It's fairly easy to reproduce:

1- Load https://bugs.chromium.org/p/chromium/issues/detail?id=741235 (should happen in other websites but with this is super easy)
2- Click and drag quickly to select the first comment going a little bit beyond it

The web process will crash.

[Sergio Villar Senin]

I don't have a Debug build ATM but could get this backtrace from Release. Looks like a generic WebCore issue in the code that traverses nodes to create and serialize the selection.

Thread 1 "WebKitWebProces" received signal SIGSEGV, Segmentation fault.
0x00007f831f7bb6fa in WebCore::StyledMarkupAccumulator::traverseNodesForSerialization(WebCore::Node*, WebCore::Node*, WebCore::StyledMarkupAccumulator::NodeTraversalMode) () from ~/checkout/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
(gdb) bt
#0  0x00007f831f7bb6fa in WebCore::StyledMarkupAccumulator::traverseNodesForSerialization(WebCore::Node*, WebCore::Node*, WebCore::StyledMarkupAccumulator::NodeTraversalMode) () from ~/checkout/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#1  0x00007f831f7bc1cd in WebCore::StyledMarkupAccumulator::serializeNodes(WebCore::Position const&, WebCore::Position const&) () from ~/checkout/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#2  0x00007f831f7bc780 in WebCore::serializePreservingVisualAppearanceInternal(WebCore::Position const&, WebCore::Position const&, WTF::Vector<WebCore::Node*, 0ul, WTF::CrashOnOverflow, 16ul>*, WebCore::ResolveURLs, WebCore::SerializeComposedTree, WebCore::AnnotateForInterchange, WebCore::ConvertBlocksToInlines, WebCore::StandardFontFamilySerializationMode, WebCore::MSOListMode) () from ~/checkout/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#3  0x00007f831f7be99a in WebCore::serializePreservingVisualAppearance(WebCore::VisibleSelection const&, WebCore::ResolveURLs, WebCore::SerializeComposedTree, WTF::Vector<WebCore::Node*, 0ul, WTF::CrashOnOverflow, 16ul>*) () from ~/checkout/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#4  0x00007f831eb7d727 in WebKit::WebEditorClient::updateGlobalSelection(WebCore::Frame*) () from ~/checkout/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#5  0x00007f831f72b26f in WebCore::Editor::respondToChangedSelection(WebCore::VisibleSelection const&, WTF::OptionSet<WebCore::FrameSelection::SetSelectionOption>) () from ~/checkout/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#6  0x00007f831f73be6f in WebCore::FrameSelection::setSelectionWithoutUpdatingAppearance(WebCore::VisibleSelection const&, WTF::OptionSet<WebCore::FrameSelection::SetSelectionOption>, WebCore::FrameSelection::CursorAlignOnScroll, WebCore::TextGranularity) () from ~/checkout/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#7  0x00007f831f7372e4 in WebCore::FrameSelection::setSelection(WebCore::VisibleSelection const&, WTF::OptionSet<WebCore::FrameSelection::SetSelectionOption>, WebCore::AXTextStateChangeIntent, WebCore::FrameSelection::CursorAlignOnScroll, WebCore::TextGranularity) () from ~/checkout/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#8  0x00007f831f73966c in WebCore::FrameSelection::setSelectionByMouseIfDifferent(WebCore::VisibleSelection const&, WebCore::TextGranularity, WebCore::FrameSelection::EndPointsAdjustmentMode) () from ~/checkout/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#9  0x00007f831fb5ee67 in WebCore::EventHandler::updateSelectionForMouseDrag(WebCore::HitTestResult const&) () from ~/checkout/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#10 0x00007f831fb7c6a9 in WebCore::EventHandler::handleMouseDraggedEvent(WebCore::MouseEventWithHitTestResults const&, WebCore::CheckDragHysteresis) () from ~/checkout/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#11 0x00007f831fb842df in WebCore::EventHandler::handleMouseMoveEvent(WebCore::PlatformMouseEvent const&, WebCore::HitTestResult*, bool) [clone .part.0] () from ~/checkout/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#12 0x00007f831fb8449d in WebCore::EventHandler::mouseMoved(WebCore::PlatformMouseEvent const&) () from ~/checkout/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#13 0x00007f831eb8a7f2 in WebKit::WebPage::mouseEvent(WebKit::WebMouseEvent const&) () from ~/checkout/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37

[Sergio Villar Senin]

*** This bug has been marked as a duplicate of bug 199224 ***