Bug 83118 – Assert triggers VisibleSelection::adjustSelectionToAvoidCrossingShadowBoundaries

• Status: RESOLVED
• Resolution: FIXED
• Component: HTML Editing

[Shinya Kawanaka]

This assertion is triggered by the attached repro.

[Shinya Kawanaka]

Created attachment 135514 [details]
Repro

[Shinya Kawanaka]

ASSERTION FAILED: m_start.anchorNode()->treeScope() == m_end.anchorNode()->treeScope()
third_party/WebKit/Source/WebCore/editing/VisibleSelection.cpp(481) : void WebCore::VisibleSelection::adjustSelectionToAvoidCrossingShadowBoundaries()
1   0x149999b
2   0x14994f8
3   0x1497797
4   0x15f38e1
5   0x15f31d7
6   0x15f70a0
7   0x15f67dc
8   0x4bf848
9   0x4c3fbc
10  0x438350
11  0x4392bb
12  0x437f05
13  0x43dfd0
14  0x42b4da
15  0x42ab97
16  0x130e497
17  0x130e60d
18  0xb2b8b5
19  0xb26344
20  0xb26315
21  0xe7eeec0618e
[27468:27468:1116372213327:ERROR:process_util_posix.cc(142)] Received signal 11
	base::debug::StackTrace::StackTrace() [0x8562e2]
	base::(anonymous namespace)::StackDumpSignalHandler() [0x80fe61]
	0x7fa953064af0
	WebCore::VisibleSelection::adjustSelectionToAvoidCrossingShadowBoundaries() [0x14999a5]
	WebCore::VisibleSelection::validate() [0x14994f8]
	WebCore::VisibleSelection::setExtent() [0x1497797]
	WebCore::EventHandler::updateSelectionForMouseDrag() [0x15f38e1]
	WebCore::EventHandler::handleMouseDraggedEvent() [0x15f31d7]
	WebCore::EventHandler::handleMouseMoveEvent() [0x15f70a0]
	WebCore::EventHandler::mouseMoved() [0x15f67dc]
	WebKit::WebViewImpl::mouseMove() [0x4bf848]
	WebKit::WebViewImpl::handleInputEvent() [0x4c3fbc]
	EventSender::doMouseMove() [0x438350]
	EventSender::replaySavedEvents() [0x4392bb]
	EventSender::mouseUp() [0x437f05]
	CppBoundClass::MemberCallback<>::run() [0x43dfd0]
	CppBoundClass::invoke() [0x42b4da]
	CppNPObject::invoke() [0x42ab97]
	WebCore::npObjectInvokeImpl() [0x130e497]
	WebCore::npObjectMethodHandler() [0x130e60d]
	v8::internal::HandleApiCallHelper<>() [0xb2b8b5]
	v8::internal::Builtin_Impl_HandleApiCall() [0xb26344]
	v8::internal::Builtin_HandleApiCall() [0xb26315]
	0xe7eeec0618e

[Shinya Kawanaka]

Created attachment 135756 [details]
Patch

[Hajime Morrita]

Comment on attachment 135756 [details]
Patch

It looks All code in the change touches anchorNode()->treeScope().
My feeling is that we could model stuff with TreeScope as the center.
Such refactoring may clarify the fact the scope guards shadow nodes from from leaking.

[Shinya Kawanaka]

Created attachment 135968 [details]
WIP

[WebKit Review Bot]

Attachment 135968 [details] did not pass style-queue:

Failed to run "['Tools/Scripts/check-webkit-style', '--diff-files', u'LayoutTests/ChangeLog', u'LayoutTests/fast..." exit_code: 1
Source/WebCore/dom/TreeScopeAdjuster.cpp:29:  Alphabetical sorting problem.  [build/include_order] [4]
Source/WebCore/dom/TreeScopeAdjuster.cpp:39:  Place brace on its own line for function definitions.  [whitespace/braces] [4]
Total errors found: 2 in 15 files


If any of these errors are false positives, please file a bug against check-webkit-style.

[Shinya Kawanaka]

Created attachment 135970 [details]
Patch

[Build Bot]

Comment on attachment 135970 [details]
Patch

Attachment 135970 [details] did not pass mac-ews (mac):
Output: http://queues.webkit.org/results/12335693

[Build Bot]

Comment on attachment 135970 [details]
Patch

Attachment 135970 [details] did not pass mac-ews (mac):
Output: http://queues.webkit.org/results/12264669

[Shinya Kawanaka]

Created attachment 135985 [details]
Patch

[Build Bot]

Comment on attachment 135985 [details]
Patch

Attachment 135985 [details] did not pass mac-ews (mac):
Output: http://queues.webkit.org/results/12339763

[Shinya Kawanaka]

Created attachment 136010 [details]
Patch

[Shinya Kawanaka]

The build passes in my local environment on Mac, but bot gets angry.... I've added a symbol in WebCore.exp.in.

[Philippe Normand]

Comment on attachment 136010 [details]
Patch

Attachment 136010 [details] did not pass gtk-ews (gtk):
Output: http://queues.webkit.org/results/12339890

[Build Bot]

Comment on attachment 136010 [details]
Patch

Attachment 136010 [details] did not pass mac-ews (mac):
Output: http://queues.webkit.org/results/12264877

[Shinya Kawanaka]

Created attachment 136195 [details]
BulidTest

[Shinya Kawanaka]

Created attachment 136197 [details]
Patch

[Shinya Kawanaka]

Created attachment 136200 [details]
Patch

[Shinya Kawanaka]

Created attachment 136387 [details]
Patch

[Hajime Morrita]

Comment on attachment 136387 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=136387&action=review

> Source/WebCore/dom/TreeScope.h:79
> +    Node* boundaryNode(Node*) const;

It looks this isn't used.

[Shinya Kawanaka]

Created attachment 136392 [details]
Patch

[WebKit Review Bot]

Comment on attachment 136392 [details]
Patch

Clearing flags on attachment: 136392

Committed r113681: <http://trac.webkit.org/changeset/113681>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.