[Webkit-unassigned] [Bug 109802] New: ASSERT(destination.deepEquivalent().anchorNode()->inDocument()) in CompositeEditCommand::moveParagraphs

Thu Feb 14 02:32:42 PST 2013

https://bugs.webkit.org/show_bug.cgi?id=109802

           Summary: ASSERT(destination.deepEquivalent().anchorNode()->inDo
                    cument()) in CompositeEditCommand::moveParagraphs
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: HTML Editing
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: reni at webkit.org
                CC: rniwa at webkit.org

During HTML fuzzing I've got the following assertion problem:

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff42aa1e1 in WebCore::CompositeEditCommand::moveParagraphs (this=0x872050, startOfParagraphToMove=..., endOfParagraphToMove=..., destination=..., 
    preserveSelection=false, preserveStyle=true) at /home/reni/Data/REPOS/webkit/Source/WebCore/editing/CompositeEditCommand.cpp:1213
1213        ASSERT(destination.deepEquivalent().anchorNode()->inDocument());

The test was:

<html>
<head>
<style type="text/css">
    p {height: 30px;}
    p {display: inline-block;}
</style>
</head>
<body>
    <ul></ul>
    <p>
    <img>
    <script>
        document.designMode = "on";
        document.execCommand("SelectAll");
        document.execCommand("JustifyCenter");
        document.body.innerText = "This tests for a crash when performing JustifyCenter.  It should not crash.";
    </script>
</html>

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.