[BlackBerry] Selection - Crash when manipulating selection by dragging handle

[Sean Wang]

RIM bug:164970
I got this:

Program received signal SIGSEGV, Segmentation fault.
[Switching to pid 63352986 tid 16]
WebCore::Node::shadowAncestorNode (this=0x0) at
/home/anilsson/dev/webkit/Source/WebCore/dom/Node.cpp:1496
1496        if (isSVGElement())
(gdb) bt
#0  WebCore::Node::shadowAncestorNode (this=0x0) at
/home/anilsson/dev/webkit/Source/WebCore/dom/Node.cpp:1496
#1  0x7bc85520 in WebCore::comparePositions (a=..., b=...)
    at /home/anilsson/dev/webkit/Source/WebCore/editing/htmlediting.cpp:78
#2  0x7bc82d00 in WebCore::VisibleSelection::setWithoutValidation
(this=0x16d74d8, base=..., extent=...)
    at
/home/anilsson/dev/webkit/Source/WebCore/editing/VisibleSelection.cpp:448
#3  0x7bbab3ce in BlackBerry::WebKit::SelectionHandler::setSelection
(this=0x14ffbb0, start=..., end=...)
    at
/home/anilsson/dev/webkit/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.cpp:492
#4  0x7bb6b99e in BlackBerry::WebKit::WebPage::setSelection (this=0x147d8a8,
startPoint=..., endPoint=...)
    at /home/anilsson/dev/webkit/Source/WebKit/blackberry/Api/WebPage.cpp:4586
#5  0x797cb2ce in BlackBerry::Platform::MethodDelegate2<void
(BlackBerry::WebKit::WebPage::*)(BlackBerry::Platform::IntPoint const&,
BlackBerry::Platform::IntPoint const&), BlackBerry::WebKit::WebPage,
BlackBerry::Platform::IntPoint, BlackBerry::Platform::IntPoint>::execute
(this=0x14fd730)
    at
/home/anilsson/dev/staging/usr/include/browser/platform/BlackBerryPlatformMessageDelegate.h:934
#6  0x7b06cbcc in BlackBerry::Platform::ExecutableMessage::execute
(this=<optimized out>)
    at
/home/anilsson/dev/platform/blackberryplatform/BlackBerryPlatformExecutableMessage.cpp:38
#7  0x7b079416 in BlackBerry::Platform::MessageClient::executeMessage
(this=0x13aeb70, message=0x141bc58, returnCode=0)
    at
/home/anilsson/dev/platform/blackberryplatform/BlackBerryPlatformMessageClient.cpp:680
#8  0x7b079b16 in BlackBerry::Platform::MessageClient::coalesceMessage
(this=0x13aeb70, message=0x141bc58, returnCode=0)
    at
/home/anilsson/dev/platform/blackberryplatform/BlackBerryPlatformMessageClient.cpp:666
#9  0x7b079bb2 in BlackBerry::Platform::MessageClient::receivePendingMessage
(this=0x13aeb70, timeout=<optimized out>)
    at
/home/anilsson/dev/platform/blackberryplatform/BlackBerryPlatformMessageClient.cpp:641
#10 0x7b079be8 in BlackBerry::Platform::MessageClient::processNextMessage
(this=0x13aeb70, timeout=<optimized out>)
    at
/home/anilsson/dev/platform/blackberryplatform/BlackBerryPlatformMessageClient.cpp:562
#11 0x7b079dbe in BlackBerry::Platform::MessageClient::exec (this=0x13aeb70)
    at
/home/anilsson/dev/platform/blackberryplatform/BlackBerryPlatformMessageClient.cpp:595
#12 0x797c57f2 in WebKitThread::exec (this=0x13aeb58) at
/home/anilsson/dev/libwebview/WebKitThread.cpp:195
#13 0x7b0775ba in BlackBerry::Platform::MessageClient::run (context=0x13aeb70)
    at
/home/anilsson/dev/platform/blackberryplatform/BlackBerryPlatformMessageClient.cpp:581
#14 0x01bafed0 in getgroups (gidsetsize=0, grouplist=0x0) at
../../getgroups.c:32
Backtrace stopped: previous frame inner to this frame (corrupt stack?)

(gdb) disassemble 
Dump of assembler code for function WebCore::Node::shadowAncestorNode() const:
=> 0x7bc259f8 <+0>:    ldr    r3, [r0, #20]
   0x7bc259fa <+2>:    lsls    r1, r3, #25
   0x7bc259fc <+4>:    bmi.n    0x7bc25a18 <WebCore::Node::shadowAncestorNode()
const+32>
   0x7bc259fe <+6>:    tst.w    r3, #65536    ; 0x10000
   0x7bc25a02 <+10>:    mov    r3, r0
   0x7bc25a04 <+12>:    beq.n    0x7bc25a0e
<WebCore::Node::shadowAncestorNode() const+22>
   0x7bc25a06 <+14>:    b.n    0x7bc25a16 <WebCore::Node::shadowAncestorNode()
const+30>
   0x7bc25a08 <+16>:    ldr    r2, [r3, #20]
   0x7bc25a0a <+18>:    lsls    r2, r2, #15
   0x7bc25a0c <+20>:    bmi.n    0x7bc25a16
<WebCore::Node::shadowAncestorNode() const+30>
   0x7bc25a0e <+22>:    ldr    r3, [r3, #12]
   0x7bc25a10 <+24>:    cmp    r3, #0
   0x7bc25a12 <+26>:    bne.n    0x7bc25a08
<WebCore::Node::shadowAncestorNode() const+16>
   0x7bc25a14 <+28>:    bx    lr
   0x7bc25a16 <+30>:    ldr    r0, [r3, #12]
   0x7bc25a18 <+32>:    bx    lr
End of assembler dump.
(gdb) info registers 
r0             0x0    0
r1             0x16d75e0    23950816
r2             0x1    1
r3             0x8    8
r4             0x0    0
r5             0x21    33
r6             0x1476360    21455712
r7             0x16d74d0    23950544
r8             0x0    0
r9             0x0    0
r10            0x16d7594    23950740
r11            0x18db988    26065288
r12            0x58    88
sp             0x16d7478    0x16d7478
lr             0x7bc85521    2076726561
pc             0x7bc259f8    0x7bc259f8 <WebCore::Node::shadowAncestorNode()
const>
cpsr           0x40000030    1073741872

[Sean Wang]

Created attachment 147717 [details]
patch

It has been internal reviewed by Antonio Gomes

[WebKit Review Bot]

Comment on attachment 147717 [details]
patch

Clearing flags on attachment: 147717

Committed r120404: <http://trac.webkit.org/changeset/120404>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.

[WebKit Review Bot]

Re-opened since this is blocked by 89193

[Rob Buis]

(In reply to comment #4)
> Re-opened since this is blocked by 89193

That one is reported as fixed, so this one can be closed again?

[Sean Wang]

This issue has been luckily fixed by unknown patches. So close it.