<rdar:///62898521> 0 com.apple.WebCore 0x00000001072190a2 WebCore::InsertListCommand::doApply() + 5154 1 com.apple.WebCore 0x0000000105f23fcd WebCore::CompositeEditCommand::apply() + 397 2 com.apple.WebCore 0x000000010720ea6d WebCore::executeInsertOrderedList(WebCore::Frame&, WebCore::Event*, WebCore::EditorCommandSource, WTF::String const&) + 109 3 com.apple.WebCore 0x0000000105f8b7b1 WebCore::Document::execCommand(WTF::String const&, bool, WTF::String const&) + 81 4 com.apple.WebCore 0x000000010638323a WebCore::jsDocumentPrototypeFunctionExecCommand(JSC::JSGlobalObject*, JSC::CallFrame*) + 426
Root cause: In function InsertListCommand::doApply, startOfLastParagraph is an empty position, and we deref the anchorNode() in the function. In this test case, we are inserting list in BODY till CANVAS and try to find individual paragraph to listify. However, because none of the elements meet the requirement for being end paragraph due to being non-editable or userSelect:none, startOfLastParagraph becomes an empty position. Test case: <style> span { -webkit-user-select: all; } </style> <body id=body contentEditable="true"><span><a draggable="true">a</a><canvas id=canvas></canvas></span> <script> body.appendChild(canvas); document.execCommand("selectAll", false); document.execCommand("insertOrderedList", false); </script> Node tree: BODY 0x60c0001030c0 (renderer 0x61200008cd40) SPAN 0x60c000103180 (renderer 0x61100022ca80) A 0x60e000091ec0 (renderer 0x61100022cbc0) #text 0x608000141120 "a" #text 0x6080001411a0 "\n" SCRIPT 0x610000051440 (renderer 0x0) #text 0x608000141220 "\n if (window.testRunner)\n testRunner.dumpAsText();\n\n body.appendChild(canvas);\n document.execCommand("selectAll", false);\n document.execCommand("insertOrderedList", false);\n document.body.innerText = "Tests inserting list at the end of a table. The test passes if WebKit doesn't crash or hit an ssertion.";\n" * CANVAS 0x61200003e2c0 (renderer 0x61100022cd00)
Created attachment 398668 [details] Patch
Comment on attachment 398668 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=398668&action=review r=me > Source/WebCore/editing/InsertListCommand.cpp:143 > + if (!startOfLastParagraph.isNull() && startOfParagraph(startOfSelection, CanSkipOverEditingBoundary) != startOfLastParagraph) { isNotNull() is probably better here than !isNull().
Created attachment 398674 [details] Patch for landing
Committed r261255: <https://trac.webkit.org/changeset/261255> All reviewed patches have been landed. Closing bug and clearing flags on attachment 398674 [details].