Bug 83679 – [GTK] flaky crash: editing/undo/undo-smart-delete-reversed-selection.html

• Status: RESOLVED
• Resolution: DUPLICATE
• Component: WebKitGTK

[Philippe Normand]

http://build.webkit.org/results/GTK%20Linux%2064-bit%20Debug/r113830%20(32334)/editing/undo/undo-smart-delete-reversed-selection-crash-log.txt


#0  0x00007f818766d5ce in WebCore::TextIterator::emitText (this=0x7ffffb9eb840, textNode=0xb7b4390, renderObject=0xb7b4418, textStartOffset=1, textEndOffset=6) at ../../Source/WebCore/editing/TextIterator.cpp:1009
1009	    ASSERT(0 <= textEndOffset && textEndOffset <= static_cast<int>(m_text.length()));

Thread 1 (Thread 0x7f817c63c900 (LWP 5044)):
#0  0x00007f818766d5ce in WebCore::TextIterator::emitText (this=0x7ffffb9eb840, textNode=0xb7b4390, renderObject=0xb7b4418, textStartOffset=1, textEndOffset=6) at ../../Source/WebCore/editing/TextIterator.cpp:1009
#1  0x00007f818766be4a in WebCore::TextIterator::handleTextBox (this=0x7ffffb9eb840) at ../../Source/WebCore/editing/TextIterator.cpp:588
#2  0x00007f818766b975 in WebCore::TextIterator::handleTextNode (this=0x7ffffb9eb840) at ../../Source/WebCore/editing/TextIterator.cpp:531
#3  0x00007f818766b086 in WebCore::TextIterator::advance (this=0x7ffffb9eb840) at ../../Source/WebCore/editing/TextIterator.cpp:404
#4  0x00007f818766ad8c in WebCore::TextIterator::TextIterator (this=0x7ffffb9eb840, r=0xb6bb1e0, behavior=WebCore::TextIteratorDefaultBehavior) at ../../Source/WebCore/editing/TextIterator.cpp:339
#5  0x00007f8187670eda in WebCore::TextIterator::rangeLength (r=0xb6bb1e0, forSelectionPreservation=false) at ../../Source/WebCore/editing/TextIterator.cpp:2392
#6  0x00007f818847a5d9 in WebCore::AXObjectCache::nodeTextChangePlatformNotification (this=0xb78a840, object=0xb661840, textChange=WebCore::AXObjectCache::AXTextDeleted, offset=0, text="z") at ../../Source/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp:189
#7  0x00007f818724c5f3 in WebCore::AXObjectCache::nodeTextChangeNotification (this=0xb78a840, renderer=0xb7b1958, textChange=WebCore::AXObjectCache::AXTextDeleted, offset=0, text="z") at ../../Source/WebCore/accessibility/AXObjectCache.cpp:545
#8  0x00007f81875fd3ad in WebCore::DeleteFromTextNodeCommand::doApply (this=0xb682ec0) at ../../Source/WebCore/editing/DeleteFromTextNodeCommand.cpp:60
#9  0x00007f81875eb7bc in WebCore::CompositeEditCommand::applyCommandToComposite (this=0xb7674d0, prpCommand=...) at ../../Source/WebCore/editing/CompositeEditCommand.cpp:256
#10 0x00007f81875ed0e1 in WebCore::CompositeEditCommand::deleteTextFromNode (this=0xb7674d0, node=..., offset=0, count=1) at ../../Source/WebCore/editing/CompositeEditCommand.cpp:466
#11 0x00007f818760010f in WebCore::DeleteSelectionCommand::deleteTextFromNode (this=0xb7674d0, node=..., offset=0, count=1) at ../../Source/WebCore/editing/DeleteSelectionCommand.cpp:406
#12 0x00007f8187600cb2 in WebCore::DeleteSelectionCommand::handleGeneralDelete (this=0xb7674d0) at ../../Source/WebCore/editing/DeleteSelectionCommand.cpp:506
#13 0x00007f8187602c9c in WebCore::DeleteSelectionCommand::doApply (this=0xb7674d0) at ../../Source/WebCore/editing/DeleteSelectionCommand.cpp:806
#14 0x00007f81875eb7bc in WebCore::CompositeEditCommand::applyCommandToComposite (this=0xb52fd80, prpCommand=...) at ../../Source/WebCore/editing/CompositeEditCommand.cpp:256
#15 0x00007f81875edc44 in WebCore::CompositeEditCommand::deleteSelection (this=0xb52fd80, selection=..., smartDelete=true, mergeBlocksAfterDelete=true, replace=false, expandForSpecialElements=true) at ../../Source/WebCore/editing/CompositeEditCommand.cpp:554
#16 0x00007f8187679068 in WebCore::TypingCommand::deleteKeyPressed (this=0xb52fd80, granularity=WebCore::CharacterGranularity, killRing=false) at ../../Source/WebCore/editing/TypingCommand.cpp:539
#17 0x00007f8187677a97 in WebCore::TypingCommand::doApply (this=0xb52fd80) at ../../Source/WebCore/editing/TypingCommand.cpp:271
#18 0x00007f81875eb56b in WebCore::CompositeEditCommand::apply (this=0xb52fd80) at ../../Source/WebCore/editing/CompositeEditCommand.cpp:204
#19 0x00007f8187676a33 in WebCore::TypingCommand::deleteKeyPressed (document=0xb6f5710, options=16, granularity=WebCore::CharacterGranularity) at ../../Source/WebCore/editing/TypingCommand.cpp:112
#20 0x00007f8187610372 in WebCore::executeDelete (frame=0x197aff0, source=WebCore::CommandFromDOM) at ../../Source/WebCore/editing/EditorCommand.cpp:333
#21 0x00007f81876144ee in WebCore::Editor::Command::execute (this=0x7ffffb9ec5c0, parameter="(null)", triggeringEvent=0x0) at ../../Source/WebCore/editing/EditorCommand.cpp:1690
#22 0x00007f81874febcb in WebCore::Document::execCommand (this=0xb6f5710, commandName="Delete", userInterface=false, value="(null)") at ../../Source/WebCore/dom/Document.cpp:4314
#23 0x00007f81880759e1 in WebCore::jsDocumentPrototypeFunctionExecCommand (exec=0x7f81395560e8) at DerivedSources/WebCore/JSDocument.cpp:2447
#24 0x00007f813c3bb258 in ?? ()
#25 0x00007ffffb9ec780 in ?? ()
#26 0x00007f813c3be9f1 in ?? ()
#27 0x00007ffffb9ec700 in ?? ()
#28 0x00007f8139527620 in ?? ()
#29 0x000000000b53ffb0 in ?? ()
#30 0x00007f813950ee60 in ?? ()
#31 0x00007f8139523020 in ?? ()
#32 0x00007f818b4a6955 in JSC::Register::Register (this=0x0) at ../../Source/JavaScriptCore/interpreter/Register.h:105
#33 0x00007f818b5fd093 in JSC::JITCode::execute (this=0x7f81394666f8, registerFile=0x1fa6508, callFrame=0x7f8139556038, globalData=0x19a0720) at ../../Source/JavaScriptCore/jit/JITCode.h:127
#34 0x00007f818b5fa1ce in JSC::Interpreter::executeCall (this=0x1fa64f0, callFrame=0x7f813950eee8, function=0x7f8139523020, callType=JSC::CallTypeJS, callData=..., thisValue=..., args=...) at ../../Source/JavaScriptCore/interpreter/Interpreter.cpp:1270
#35 0x00007f818b6b2036 in JSC::call (exec=0x7f813950eee8, functionObject=..., callType=JSC::CallTypeJS, callData=..., thisValue=..., args=...) at ../../Source/JavaScriptCore/runtime/CallData.cpp:39
#36 0x00007f8187273ebf in WebCore::JSMainThreadExecState::call (exec=0x7f813950eee8, functionObject=..., callType=JSC::CallTypeJS, callData=..., thisValue=..., args=...) at ../../Source/WebCore/bindings/js/JSMainThreadExecState.h:56
#37 0x00007f81872f2d77 in WebCore::ScheduledAction::executeFunctionInContext (this=0xb79ee50, globalObject=0x7f813950ee60, thisValue=..., context=0xb6f58b8) at ../../Source/WebCore/bindings/js/ScheduledAction.cpp:110
#38 0x00007f81872f2f4e in WebCore::ScheduledAction::execute (this=0xb79ee50, document=0xb6f5710) at ../../Source/WebCore/bindings/js/ScheduledAction.cpp:130
#39 0x00007f81872f2b3a in WebCore::ScheduledAction::execute (this=0xb79ee50, context=0xb6f58b8) at ../../Source/WebCore/bindings/js/ScheduledAction.cpp:80
#40 0x00007f818799a7c6 in WebCore::DOMTimer::fired (this=0xb79e8e0) at ../../Source/WebCore/page/DOMTimer.cpp:149
#41 0x00007f8187b29efc in WebCore::ThreadTimers::sharedTimerFiredInternal (this=0x198fd80) at ../../Source/WebCore/platform/ThreadTimers.cpp:115
#42 0x00007f8187b29e33 in WebCore::ThreadTimers::sharedTimerFired () at ../../Source/WebCore/platform/ThreadTimers.cpp:93
#43 0x00007f81884c5456 in WebCore::timeout_cb () at ../../Source/WebCore/platform/gtk/SharedTimerGtk.cpp:49
#44 0x00007f8184bcfa52 in g_timeout_dispatch () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0
#45 0x00007f8184bcdc8a in g_main_dispatch () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0
#46 0x00007f8184bce950 in g_main_context_dispatch () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0
#47 0x00007f8184bceb3a in g_main_context_iterate () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0
#48 0x00007f8184bcef70 in g_main_loop_run () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0
#49 0x00007f8185aa5e99 in gtk_main () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libgtk-3.so.0
#50 0x000000000045b2f4 in runTest (testPathOrURL=...) at ../../Tools/DumpRenderTree/gtk/DumpRenderTree.cpp:705
#51 0x000000000045a96c in runTestingServerLoop () at ../../Tools/DumpRenderTree/gtk/DumpRenderTree.cpp:492
#52 0x000000000045d988 in main (argc=2, argv=0x7ffffb9ed8c8) at ../../Tools/DumpRenderTree/gtk/DumpRenderTree.cpp:1387

[Philippe Normand]

editing/selection/directionality-after-undo-replace.html is also affected by this issue.

[Martin Robinson]

*** This bug has been marked as a duplicate of bug 63611 ***