Bug 224801 – editing/execCommand/insert-image-in-composed-list.html is crashing

• Status: RESOLVED
• Resolution: FIXED
• Component: HTML Editing

[Fujii Hironori]

Created attachment 426519 [details]
insert-image-in-composed-list-crash-log.txt

[WinCairo][Clang 12] editing/execCommand/insert-image-in-composed-list.html is crashing

WinCairo WK1/WK2 Release builds with Clang 12.0.0 reproduce the crash.
MSVC and Clang 11 don't reproduce the crash.

[Fujii Hironori]

Callstack:

WebKit2!WebCore::Node::treeScope(void) [C:\home\webkit\gb\Source\WebCore\dom\Node.h @ 359]
WebKit2!WebCore::Node::document(void) [C:\home\webkit\gb\Source\WebCore\dom\Node.h @ 354]
WebKit2!WebCore::Node::computeEditability(WebCore::Node::UserSelectAllTreatment treatment = UserSelectAllIsAlwaysNonEditable (0n1), WebCore::Node::ShouldUpdateStyle shouldUpdateStyle = DoNotUpdate (0n1))+0x8 [C:\home\webkit\gb\Source\WebCore\dom\Node.cpp @ 783]
WebKit2!WebCore::Node::hasEditableStyle(WebCore::Node::UserSelectAllTreatment treatment = <Value unavailable error>)+0x13 [C:\home\webkit\gb\Source\WebCore\dom\Node.h @ 331]
WebKit2!WebCore::Node::rootEditableElement(void)+0x23 [C:\home\webkit\gb\Source\WebCore\dom\Node.cpp @ 1335]
WebKit2!WebCore::DeleteSelectionCommand::removeRedundantBlocks(void)+0x31 [C:\home\webkit\gb\Source\WebCore\editing\DeleteSelectionCommand.cpp @ 869]
WebKit2!WebCore::DeleteSelectionCommand::doApply(void)+0x54b [C:\home\webkit\gb\Source\WebCore\editing\DeleteSelectionCommand.cpp @ 955]
WebKit2!WebCore::CompositeEditCommand::applyCommandToComposite(class WTF::Ref<WebCore::EditCommand,WTF::RawPtrTraits<WebCore::EditCommand> > * command = 0x00000005`27afe3d8)+0x20 [C:\home\webkit\gb\Source\WebCore\editing\CompositeEditCommand.cpp @ 489]
WebKit2!WebCore::CompositeEditCommand::deleteSelection(bool smartDelete = <Value unavailable error>, bool mergeBlocksAfterDelete = <Value unavailable error>, bool replace = <Value unavailable error>, bool expandForSpecialElements = <Value unavailable error>, bool sanitizeMarkup = <Value unavailable error>)+0xa3 [C:\home\webkit\gb\Source\WebCore\editing\CompositeEditCommand.cpp @ 857]
WebKit2!WebCore::ReplaceSelectionCommand::doApply(void)+0x76b [C:\home\webkit\gb\Source\WebCore\editing\ReplaceSelectionCommand.cpp @ 1147]
WebKit2!WebCore::CompositeEditCommand::apply(void)+0xb7 [C:\home\webkit\gb\Source\WebCore\editing\CompositeEditCommand.cpp @ 398]
WebKit2!WebCore::executeInsertFragment(class WebCore::Frame * frame = <Value unavailable error>, class WTF::Ref<WebCore::DocumentFragment,WTF::RawPtrTraits<WebCore::DocumentFragment> > * fragment = <Value unavailable error>)+0x5c [C:\home\webkit\gb\Source\WebCore\editing\EditorCommand.cpp @ 165]
WebKit2!WebCore::executeInsertNode(class WebCore::Frame * frame = 0x0000016b`8b96aaa0, class WTF::Ref<WebCore::Node,WTF::RawPtrTraits<WebCore::Node> > * content = 0x00000005`27afe928)+0x54 [C:\home\webkit\gb\Source\WebCore\editing\EditorCommand.cpp @ 175]
WebKit2!WebCore::executeInsertImage(class WebCore::Frame * frame = 0x0000016b`8b96aaa0, class WTF::String * value = <Value unavailable error>)+0x68 [C:\home\webkit\gb\Source\WebCore\editing\EditorCommand.cpp @ 473]
WebKit2!WebCore::Document::execCommand(class WTF::String * commandName = <Value unavailable error>, bool userInterface = <Value unavailable error>, class WTF::String * value = <Value unavailable error>)+0x57 [C:\home\webkit\gb\Source\WebCore\dom\Document.cpp @ 5707]
WebKit2!WebCore::jsDocumentPrototypeFunction_execCommandBody(class JSC::JSGlobalObject * lexicalGlobalObject = 0x0000016b`d15c2248, class JSC::CallFrame * callFrame = <Value unavailable error>, class WebCore::JSDocument * castedThis = <Value unavailable error>)+0x1a1 [C:\home\webkit\gb\WebKitBuild\Release\WebCore\DerivedSources\JSDocument.cpp @ 5850]
WebKit2!WebCore::IDLOperation<WebCore::JSDocument>::call(class JSC::JSGlobalObject * lexicalGlobalObject = 0x0000016b`d15c2248, class JSC::CallFrame * callFrame = <Value unavailable error>, char * operationName = <Value unavailable error>)+0x1fd [C:\home\webkit\gb\Source\WebCore\bindings\js\JSDOMOperation.h @ 55]
WebKit2!WebCore::jsDocumentPrototypeFunction_execCommand(class JSC::JSGlobalObject * lexicalGlobalObject = 0x0000016b`d15c2248, class JSC::CallFrame * callFrame = <Value unavailable error>)+0x229 [C:\home\webkit\gb\WebKitBuild\Release\WebCore\DerivedSources\JSDocument.cpp @ 5855]

[Fujii Hironori]

Created attachment 426520 [details]
debugging patch

'node' is null in DeleteSelectionCommand::removeRedundantBlocks.
This crash can be reproduced in Debug build by applying this debugging patch.

[Fujii Hironori]

Created attachment 426521 [details]
Patch

[Fujii Hironori]

Created attachment 426522 [details]
Patch

[Fujii Hironori]

Comment on attachment 426522 [details]
Patch

Clearing flags on attachment: 426522

Committed r276317 (236798@main): <https://commits.webkit.org/236798@main>

[Fujii Hironori]

All reviewed patches have been landed.  Closing bug.

[Fujii Hironori]

*** Bug 223960 has been marked as a duplicate of this bug. ***

[Ling Ho]

rdar://76914240