Bug 220955 - Crash from CompositeEditCommand::moveParagraphs() using Position instead of VisiblePosition
Summary: Crash from CompositeEditCommand::moveParagraphs() using Position instead of V...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: HTML Editing (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2021-01-25 15:22 PST by Julian Gonzalez
Modified: 2021-01-28 02:58 PST (History)
4 users (show)

See Also:


Attachments
Patch (4.79 KB, patch)
2021-01-25 15:30 PST, Julian Gonzalez
no flags Details | Formatted Diff | Diff
Patch (4.52 KB, patch)
2021-01-27 17:19 PST, Julian Gonzalez
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Julian Gonzalez 2021-01-25 15:22:18 PST
frame #0: WebCore`WebCore::makeBoundaryPoint(WebCore::VisiblePosition const&)+81
frame #1: WebCore`decltype(makeSimpleRangeHelper(makeBoundaryPointHelper(std::forward<WebCore::VisiblePosition const&>(fp)), makeBoundaryPointHelper(std::forward<WebCore::VisiblePosition&>(fp)))) WebCore::makeSimpleRange<WebCore::VisiblePosition const&, WebCore::VisiblePosition&>(WebCore::VisiblePosition const&, WebCore::VisiblePosition&)+26
frame #2: WebCore`WebCore::CompositeEditCommand::moveParagraphs(WebCore::VisiblePosition const&, WebCore::VisiblePosition const&, WebCore::VisiblePosition const&, bool, bool)+403
frame #3: WebCore`WebCore::InsertListCommand::doApplyForSingleParagraph(bool, WebCore::HTMLQualifiedName const&, WebCore::SimpleRange&)+7504
frame #4: WebCore`WebCore::InsertListCommand::doApply()+7534
frame #5: WebCore`WebCore::CompositeEditCommand::applyCommandToComposite(WTF::Ref<WebCore::EditCommand, WTF::DumbPtrTraits<WebCore::EditCommand> >&&)+79
frame #6: WebCore`WebCore::IndentOutdentCommand::outdentParagraph()+690
frame #7: WebCore`WebCore::IndentOutdentCommand::formatSelection(WebCore::VisiblePosition const&, WebCore::VisiblePosition const&)+220
frame #8: WebCore`WebCore::ApplyBlockElementCommand::doApply()+1256
frame #9: WebCore`WebCore::CompositeEditCommand::apply()+500
frame #10: WebCore`WebCore::executeOutdent(WebCore::Frame&, WebCore::Event*, WebCore::EditorCommandSource, WTF::String const&)+229
frame #11: WebCore`WebCore::Document::execCommand(WTF::String const&, bool, WTF::String const&)+77

The call to makeSimpleRange(start, end) requires non-null VisiblePositions - not non-null Positions.
Similar to bug 220630

<rdar://problem/70880426>
Comment 1 Julian Gonzalez 2021-01-25 15:30:02 PST
Created attachment 418346 [details]
Patch
Comment 2 Julian Gonzalez 2021-01-25 17:48:51 PST
Test failures here look legitimate (though I can't reproduce them locally). I'll keep working on this.
Comment 3 Ryosuke Niwa 2021-01-25 17:58:25 PST
Comment on attachment 418346 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=418346&action=review

> LayoutTests/editing/inserting/paragraph-outdent-animationframe-crash.html:20
> +    document.execCommand("selectAll", false);
> +    window.requestAnimationFrame(dooutdent);

I think the test failure comes from this code running after this test had finished running.
You need to add testRunner.waitUntilDone where you call dumpAsText,
and call testRunner.notifyDone when the test is done running perhaps at the end of dooutdent?
Be sure to verify that the crash still reproduces without the fix if you made those changes to the test.
Comment 4 Julian Gonzalez 2021-01-27 17:13:28 PST
(In reply to Ryosuke Niwa from comment #3)
> Comment on attachment 418346 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=418346&action=review
> 
> > LayoutTests/editing/inserting/paragraph-outdent-animationframe-crash.html:20
> > +    document.execCommand("selectAll", false);
> > +    window.requestAnimationFrame(dooutdent);
> 
> I think the test failure comes from this code running after this test had
> finished running.
> You need to add testRunner.waitUntilDone where you call dumpAsText,
> and call testRunner.notifyDone when the test is done running perhaps at the
> end of dooutdent?
> Be sure to verify that the crash still reproduces without the fix if you
> made those changes to the test.

This ended up being a little more complicated, but Ryosuke figured it out. Thanks to him for cleaning the test up!
Comment 5 Julian Gonzalez 2021-01-27 17:19:02 PST
Created attachment 418602 [details]
Patch
Comment 6 Ryosuke Niwa 2021-01-28 02:55:21 PST
Comment on attachment 418602 [details]
Patch

Looks good.
Comment 7 EWS 2021-01-28 02:58:29 PST
Committed r272008: <https://trac.webkit.org/changeset/272008>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 418602 [details].