[Webkit-unassigned] [Bug 123732] New: ASSERTION FAILED: !m_insertChild->parentNode() in WebCore::InsertNodeBeforeCommand::InsertNodeBeforeCommand

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=123732

           Summary: ASSERTION FAILED: !m_insertChild->parentNode() in
                    WebCore::InsertNodeBeforeCommand::InsertNodeBeforeComm
                    and
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: HTML Editing
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: reni at webkit.org
            Blocks: 116980


Created an attachment (id=215905)
 --> (https://bugs.webkit.org/attachment.cgi?id=215905&action=review)
Test case

The failing test:

<details></details>
<font>A</font>
<style></style>
<iframe onload="   
        document.designMode='on';     
        document.execCommand('selectall');     
        document.execCommand('italic');
        document.execCommand('RemoveFormat');" seamless=" ">
</iframe>


The backtrace:


Program received signal SIGSEGV, Segmentation fault.
[Switching to LWP 21412]
0x00007ffff4af0ac1 in WTFCrash () at /home/reni/Data/REPOS/webkitnix/Source/WTF/wtf/Assertions.cpp:342
342        *(int *)(uintptr_t)0xbbadbeef = 0;
(gdb) bt
#0  0x00007ffff4af0ac1 in WTFCrash () at /home/reni/Data/REPOS/webkitnix/Source/WTF/wtf/Assertions.cpp:342
#1  0x00007ffff335e245 in WebCore::InsertNodeBeforeCommand::InsertNodeBeforeCommand (this=0x8326a0, insertChild=<incomplete type>, 
    refChild=<incomplete type>, shouldAssumeContentIsAlwaysEditable=WebCore::DoNotAssumeContentIsAlwaysEditable)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/InsertNodeBeforeCommand.cpp:44
#2  0x00007ffff3318759 in WebCore::InsertNodeBeforeCommand::create (childToInsert=<incomplete type>, childToInsertBefore=<incomplete type>, 
    shouldAssumeContentIsAlwaysEditable=WebCore::DoNotAssumeContentIsAlwaysEditable)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/InsertNodeBeforeCommand.h:38
#3  0x00007ffff3310118 in WebCore::CompositeEditCommand::insertNodeBefore (this=0x832020, insertChild=<incomplete type>, refChild=<incomplete type>, 
    shouldAssumeContentIsAlwaysEditable=WebCore::DoNotAssumeContentIsAlwaysEditable)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/CompositeEditCommand.cpp:329
#4  0x00007ffff336b815 in WebCore::RemoveNodePreservingChildrenCommand::doApply (this=0x832020)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/RemoveNodePreservingChildrenCommand.cpp:52
#5  0x00007ffff330fb3c in WebCore::CompositeEditCommand::applyCommandToComposite (this=0x821650, prpCommand=<incomplete type>)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/CompositeEditCommand.cpp:262
#6  0x00007ffff3310ae0 in WebCore::CompositeEditCommand::removeNodePreservingChildren (this=0x821650, node=<incomplete type>, 
    shouldAssumeContentIsAlwaysEditable=WebCore::DoNotAssumeContentIsAlwaysEditable)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/CompositeEditCommand.cpp:405
#7  0x00007ffff33044d5 in WebCore::ApplyStyleCommand::removeInlineStyleFromElement (this=0x821650, style=0x831690, element=<incomplete type>, 
    mode=WebCore::ApplyStyleCommand::RemoveIfNeeded, extractedStyle=0x74add0)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/ApplyStyleCommand.cpp:890
#8  0x00007ffff3305175 in WebCore::ApplyStyleCommand::pushDownInlineStyleAroundNode (this=0x821650, style=0x831690, targetNode=0x8bcbd0)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/ApplyStyleCommand.cpp:1051
#9  0x00007ffff33057c3 in WebCore::ApplyStyleCommand::removeInlineStyle (this=0x821650, style=0x831690, start=..., end=...)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/ApplyStyleCommand.cpp:1104
#10 0x00007ffff3302a12 in WebCore::ApplyStyleCommand::applyInlineStyle (this=0x821650, style=0x831690)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/ApplyStyleCommand.cpp:630
#11 0x00007ffff32ffe57 in WebCore::ApplyStyleCommand::doApply (this=0x821650)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/ApplyStyleCommand.cpp:220
#12 0x00007ffff330fb3c in WebCore::CompositeEditCommand::applyCommandToComposite (this=0x831290, prpCommand=<incomplete type>)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/CompositeEditCommand.cpp:262
#13 0x00007ffff336afc5 in WebCore::RemoveFormatCommand::doApply (this=0x831290)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/RemoveFormatCommand.cpp:92
#14 0x00007ffff330f8fc in WebCore::CompositeEditCommand::apply (this=0x831290)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/CompositeEditCommand.cpp:211
#15 0x00007ffff330f6fc in WebCore::applyCommand (command=<incomplete type>)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/CompositeEditCommand.cpp:170
#16 0x00007ffff3333335 in WebCore::Editor::removeFormattingAndStyle (this=0x7a1e60) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/Editor.cpp:700
#17 0x00007ffff3347652 in WebCore::executeRemoveFormat (frame=...) at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/EditorCommand.cpp:977
#18 0x00007ffff33491af in WebCore::Editor::Command::execute (this=0x7fffffffa810, parameter=..., triggeringEvent=0x0)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/editing/EditorCommand.cpp:1713
#19 0x00007ffff32106ac in WebCore::Document::execCommand (this=0x81b610, commandName=..., userInterface=false, value=...)
    at /home/reni/Data/REPOS/webkitnix/Source/WebCore/dom/Document.cpp:4110
#20 0x00007ffff3fab309 in WebCore::jsDocumentPrototypeFunctionExecCommand (exec=0x7fffa37fef50)
    at /home/reni/Data/REPOS/webkitnix/WebKitBuild/Debug/DerivedSources/WebCore/JSDocument.cpp:2705
#21 0x00007fffaa282105 in ?? ()
#22 0x00007fffffffa950 in ?? ()
#23 0x00007ffff4875638 in llint_op_call () from /home/reni/Data/REPOS/webkitnix/WebKitBuild/Debug/lib/libWebKitNix.so.0
#24 0x00007fffaa282940 in ?? ()
#25 0x0000000000689dd8 in ?? ()
#26 0x0000000000000001 in ?? ()
#27 0x0000000000000001 in ?? ()
#28 0x00000000ffffffff in ?? ()
---Type <return> to continue, or q <return> to quit---
#29 0x0000000000000000 in ?? ()

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.