REPRODUCIBLE ASSERT: Cannot paste HTML into a contenteditable region in an XHTML document

[Levi Weintraub]

I can copy portions of an XHTML document and paste them into a contenteditable div on an HTML document, but nothing happens when I try to paste into an equivalent div in an XHTML document. Pasting plaintext works fine.

Will attach test case.

[Levi Weintraub]

Created attachment 8332 [details]
Test Case

Steps to reproduce:
1. Highlight the text that says "Copy this" and copy it.
2. Click inside the contenteditable region below next to where it says "Paste it here."
3. Attempt to paste.

Alternatively, you can highlight the "Copy this" text and attempt to drag it into the contenteditable region.

[Dan POPA]

(In reply to comment #1)
> Created an attachment (id=8332) [edit]
> Test Case
> 
> Steps to reproduce:
> 1. Highlight the text that says "Copy this" and copy it.
> 2. Click inside the contenteditable region below next to where it says "Paste
> it here."
> 3. Attempt to paste.
> 
> Alternatively, you can highlight the "Copy this" text and attempt to drag it
> into the contenteditable region.
> 
I still can reproduce this in WebKit-SVN-r19955.dmg using the attached testcase.

[David Kilzer (:ddkilzer)]

On a local debug build of WebKit r19953, the steps in Comment #1 lead to an assertion failure.  Console output:

ASSERTION FAILED: fragment
(/path/to/WebKit/WebCore/editing/markup.cpp:586 WTF::PassRefPtr<WebCore::DocumentFragment> WebCore::createFragmentFromMarkup(WebCore::Document*, const WebCore::String&, const WebCore::String&))
Segmentation fault

Stack trace:

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_INVALID_ADDRESS (0x0001) at 0xbbadbeef

Thread 0 Crashed:
0   com.apple.WebCore        	0x01249e00 WebCore::createFragmentFromMarkup(WebCore::Document*, WebCore::String const&, WebCore::String const&) + 288 (markup.cpp:586)
1   com.apple.WebCore        	0x01115478 -[WebCoreFrameBridge documentFragmentWithMarkupString:baseURLString:] + 232 (WebCoreFrameBridge.mm:1058)
2   com.apple.WebKit         	0x0033bc2c -[WebDataSource(WebInternal) _documentFragmentWithArchive:] + 532 (WebDataSource.mm:245)
3   com.apple.WebKit         	0x00366958 -[WebHTMLView(WebPrivate) _documentFragmentFromPasteboard:forType:inContext:subresources:] + 328 (WebHTMLView.mm:1814)
4   com.apple.WebKit         	0x00344330 -[WebHTMLView(WebHTMLViewFileInternal) _documentFragmentFromPasteboard:inContext:allowPlainText:chosePlainText:] + 220 (WebHTMLView.mm:450)
5   com.apple.WebKit         	0x00344e70 -[WebHTMLView(WebHTMLViewFileInternal) _pasteWithPasteboard:allowPlainText:] + 136 (WebHTMLView.mm:560)
6   com.apple.WebKit         	0x00359b24 -[WebHTMLView(WebInternal) paste:] + 360 (WebHTMLView.mm:5104)
7   com.apple.AppKit         	0x937adc4c -[NSApplication sendAction:to:from:] + 108
8   com.apple.Safari         	0x0002956c 0x1000 + 165228
9   com.apple.AppKit         	0x938084b8 -[NSMenu performActionForItemAtIndex:] + 392
10  com.apple.AppKit         	0x9380823c -[NSCarbonMenuImpl performActionWithHighlightingForItemAtIndex:] + 104
11  com.apple.AppKit         	0x93807ce4 -[NSMenu performKeyEquivalent:] + 272
12  com.apple.AppKit         	0x93807930 -[NSApplication _handleKeyEquivalent:] + 328
13  com.apple.AppKit         	0x93711408 -[NSApplication sendEvent:] + 2944
14  com.apple.Safari         	0x00021238 0x1000 + 131640
15  com.apple.AppKit         	0x93708d10 -[NSApplication run] + 508
16  com.apple.AppKit         	0x937f987c NSApplicationMain + 452
17  com.apple.Safari         	0x0005c77c 0x1000 + 374652
18  com.apple.Safari         	0x0005c624 0x1000 + 374308

[Mark Rowe (bdash)]

<rdar://problem/5045708>

[Darin Adler]

Created attachment 13559 [details]
patch

This is enough to get plain text pasting working and to eliminate the assertion and crash.

Rich text pasting still won't work, but that should presumably be covered by another bug.

[Justin Garcia]

Comment on attachment 13559 [details]
patch

r=me

[Darin Adler]

Committed revision 20092.