[Webkit-unassigned] [Bug 86153] New: ASSERT failures in editing code.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=86153

           Summary: ASSERT failures in editing code.
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: HTML Editing
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: inferno at chromium.org


The below unminimized testcase hits a bunch of functional asserts.
e.g.
VisiblePosition VisiblePosition::previous(EditingBoundaryCrossingRule rule) const
{
........

   VisiblePosition prev = VisiblePosition(pos, DOWNSTREAM);
   ASSERT(prev != *this);

e.g.
derObject* container) const
{
   LayoutSize offset;
   LayoutPoint referencePoint;
   const RenderObject* currContainer = this;
   do {
       RenderObject* nextContainer = currContainer->container();
       ASSERT(nextContainer);


Testcase::

<script>
var aoScriptElements = document.getElementsByTagName("script");
for(var i = 0; i < aoScriptElements.length; i++) {
  aoScriptElements[i].parentNode.removeChild(aoScriptElements[i]);
}
var event_handler_230_DOMSubtreeModified_active = false;
function event_handler_230_DOMSubtreeModified() {
  if (event_handler_230_DOMSubtreeModified_active) return ;
  event_handler_230_DOMSubtreeModified_active = true;
  var oElement = event.srcElement;
  var oSelection=window.getSelection();
  if (!oSelection.rangeCount)
      document.execCommand("SelectAll", false, false)
  var oRange = oSelection.rangeCount ? oSelection.getRangeAt(14 % oSelection.rangeCount) : null;
  try{oRange.deleteContents()}catch(e){}
  var oRange = oSelection.rangeCount ? oSelection.getRangeAt(29 % oSelection.rangeCount) : null;
  var aoElements = document.getElementsByTagName("*");
  var oParentElement = aoElements[9 % aoElements.length];
  try{oRange.surroundContents(oParentElement)}catch(e){}
  var oRange = oSelection.rangeCount ? oSelection.getRangeAt(98 % oSelection.rangeCount) : null;
      try{aoElements[71 % aoElements.length].appendChild(oRange.cloneContents())}catch(e){}
  var oParent = aoElements[82 % aoElements.length];
  var oPreviousSibling = oParent.childNodes[6 % oParent.childNodes.length];
  if (!oElement.parentNode) 
      try{oParent.insertBefore(oElement, oPreviousSibling)}catch(e){}
  event_handler_230_DOMSubtreeModified_active = false;
}
document.addEventListener("DOMSubtreeModified", event_handler_230_DOMSubtreeModified, false);
var event_handler_231_DOMNodeInserted_active = false;
function event_handler_231_DOMNodeInserted() {
  if (event_handler_231_DOMNodeInserted_active) return ;
  event_handler_231_DOMNodeInserted_active = true;
  var oElement = event.srcElement;
  document.designMode = document.designMode == "on" ? "off" : "on";
  var oSelection=window.getSelection();
  try{oElement.contentEditable = oElement.contentEditable == "true" ? "false" : "true";}catch(e){}
  if (!oSelection.rangeCount)
      document.execCommand("SelectAll", false, false)
  try{oSelection.deleteFromDocument()}catch(e){}
  try{oParent.appendChild(oDocumentFragment)}catch(e){}
  try{oElement.innerHTML = '<svg><foreignObject><svg></svg><svg></svg>x<%%%%%%)L|:9</svg><svg>x'}catch(e){}
  event_handler_231_DOMNodeInserted_active = false;
}
document.addEventListener("DOMNodeInserted", event_handler_231_DOMNodeInserted, true);
var event_handler_233_DOMNodeInsertedIntoDocument_active = false;
var event_handler_233_DOMNodeInsertedIntoDocument_fired_count = 0;
function event_handler_233_DOMNodeInsertedIntoDocument() {
  if (event_handler_233_DOMNodeInsertedIntoDocument_active) return ;
  event_handler_233_DOMNodeInsertedIntoDocument_fired_count++;
  if (event_handler_233_DOMNodeInsertedIntoDocument_fired_count >= 20) return;
  event_handler_233_DOMNodeInsertedIntoDocument_active = true;
  var oElement = event.srcElement;
  try{oElement.textContent = 'x'}catch(e){}
  var oSelection=window.getSelection();
  try{oSelection.deleteFromDocument()}catch(e){}
  document.execCommand('InsertParagraph',false,false);
  document.execCommand('JustifyCenter',false,false);
  event_handler_233_DOMNodeInsertedIntoDocument_active = false;
}
document.addEventListener("DOMNodeInsertedIntoDocument", event_handler_233_DOMNodeInsertedIntoDocument, true);
window.onload=function(){
  var aoElements = document.getElementsByTagName("*");
  var oElement = aoElements[83 % aoElements.length];
  try{oElement.parentNode.replaceChild(document.createElementNS('http://www.w3.org/2000/svg', 'animateMotion'), oElement)}catch(e){}
  var oSelection=window.getSelection();
  try{oSelection.deleteFromDocument()}catch(e){}
  document.execCommand("Undo",false,false);
  document.execCommand("Redo",false,false);
};
</script>
<style>
*{
  border:groove transparent;
  -webkit-appearance:media-controls-fullscreen-background;
}
.CLASS10{
  -webkit-appearance:searchfield-results-button;
}
*:optional{
  text-align:-webkit-auto;
</style>
<meta>
<link>
<div>
<i class="CLASS10 CLASS9">
<button>
</button>
<select>
</select>
<textarea</textarea>
</i>
<select>
<option class="CLASS6"</option>
<option>
<optgroup>
<optgroup>
<option>
</select>
<table>
<caption>
<span>
<input>
<col>
</table>
<form>
<div>
<textarea</textarea>
<button</button>
<button</button>
<button>
<samp>
<input</button>
</div>
<table>
<caption>
<button>
<svg>
<foreignObject</foreignObject>
<use</svg>
<cite</cite>
<div>
<input</div>
<table</table>
<div</div>
<h6>
<textarea</textarea>
<strong>
<button>
<rbc>
<rb</ruby>
</strong>
</caption>
<colgroup>

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.