[Webkit-unassigned] [Bug 120625] New: ASSERTION FAILED: commonScope in WebCore::comparePositions
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Tue Sep 3 02:36:42 PDT 2013
https://bugs.webkit.org/show_bug.cgi?id=120625
Summary: ASSERTION FAILED: commonScope in
WebCore::comparePositions
Product: WebKit
Version: 528+ (Nightly build)
Platform: Unspecified
OS/Version: Unspecified
Status: NEW
Severity: Normal
Priority: P2
Component: HTML Editing
AssignedTo: webkit-unassigned at lists.webkit.org
ReportedBy: reni at webkit.org
Blocks: 116980
Created an attachment (id=210340)
--> (https://bugs.webkit.org/attachment.cgi?id=210340&action=review)
Test case
If you load the attached test you will get the assertion failure above (it's possible you have to force a refresh too). This test is a part of LayoutTests/editing/selection/selection-in-iframe-removed-crash.html what was introduced in r144400 as the test case of a security bug. Nevertheless the null check in the next line defends us from serious problems hopefully.
<html>
<script>
var docElement = document.documentElement;
function crash() {
iframe1 = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe");
iframe1.setAttribute("srcdoc", "ABC");
docElement.appendChild(iframe1);
document1 = document.implementation.createDocument("", null);
iframe1.addEventListener("DOMFocusOut", function () {
document1.adoptNode(iframe1); }, false);
iframe1.focus();
setTimeout("finish();", 0);
}
function finish() {
document.designMode = "on";
range1 = document.createRange();
range1.selectNodeContents(iframe1.contentDocument);
window.getSelection().addRange(range1);
}
document.addEventListener("DOMContentLoaded", crash, false);
</script>
</html>
The backtrace:
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff56dafad in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:342
342 *(int *)(uintptr_t)0xbbadbeef = 0;
(gdb) bt
#0 0x00007ffff56dafad in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:342
#1 0x00007ffff42dfe4a in WebCore::comparePositions (a=..., b=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/htmlediting.cpp:79
#2 0x00007ffff4322ad6 in WebCore::VisibleSelection::toNormalizedRange (this=0x7cfab8)
at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/VisibleSelection.cpp:173
#3 0x00007ffff3b6868f in WebCore::FrameSelection::toNormalizedRange (this=0x7cfa90)
at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/FrameSelection.h:205
#4 0x00007ffff3b6fe85 in WebCore::EditorClientQt::respondToChangedSelection (this=0x765660, frame=0x7d14b0)
at /home/reni/Data/REPOS/webkit_sec/Source/WebKit/qt/WebCoreSupport/EditorClientQt.cpp:207
#5 0x00007ffff42bf2c5 in WebCore::Editor::notifyComponentsOnChangedSelection (this=0x7cf930, oldSelection=..., options=6)
at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/Editor.cpp:533
#6 0x00007ffff42cbdea in WebCore::Editor::respondToChangedSelection (this=0x7cf930, oldSelection=..., options=6)
at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/Editor.cpp:3042
#7 0x00007ffff42d7ef7 in WebCore::FrameSelection::setSelection (this=0x7cfa90, newSelection=..., options=6,
align=WebCore::FrameSelection::AlignCursorOnScrollIfNeeded, granularity=WebCore::CharacterGranularity)
at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/FrameSelection.cpp:329
#8 0x00007ffff42ddce3 in WebCore::FrameSelection::selectFrameElementInParentIfFullySelected (this=0x8b41f0)
at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/FrameSelection.cpp:1630
#9 0x00007ffff42d7eb8 in WebCore::FrameSelection::setSelection (this=0x8b41f0, newSelection=..., options=6,
align=WebCore::FrameSelection::AlignCursorOnScrollIfNeeded, granularity=WebCore::CharacterGranularity)
at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/FrameSelection.cpp:327
#10 0x00007ffff42d7ce7 in WebCore::FrameSelection::setSelection (this=0x7cfa90, newSelection=..., options=6,
align=WebCore::FrameSelection::AlignCursorOnScrollIfNeeded, granularity=WebCore::CharacterGranularity)
at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/FrameSelection.cpp:283
#11 0x00007ffff4622357 in WebCore::DOMSelection::addRange (this=0x922150, r=0x9488a0)
at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/page/DOMSelection.cpp:395
#12 0x00007ffff502f2b2 in WebCore::jsDOMSelectionPrototypeFunctionAddRange (exec=0x7fff941e20e8) at generated/JSDOMSelection.cpp:439
#13 0x00007fff9ffff0e5 in ?? ()
#14 0x00007fffffffbfa0 in ?? ()
#15 0x00007ffff679ffa2 in llint_op_call () from /home/reni/Data/REPOS/webkit_sec/WebKitBuild/Debug/lib/libQt5WebKit.so.5
#16 0x00007fff941e2058 in ?? ()
#17 0x00000000007d0e98 in ?? ()
#18 0x00007fffffffbf60 in ?? ()
#19 0x00007ffff5506ba3 in JSC::JSStack::installTrapsAfterFrame (this=0x0, frame=0x0)
at /home/reni/Data/REPOS/webkit_sec/Source/JavaScriptCore/interpreter/JSStackInlines.h:212
#20 0x00007ffff551752c in JSC::JITCode::execute (this=0x932510, stack=0x7d0e98, callFrame=0x7fff941e2058, vm=0x815ab0)
at /home/reni/Data/REPOS/webkit_sec/Source/JavaScriptCore/jit/JITCode.cpp:46
#21 0x00007ffff5503419 in JSC::Interpreter::execute (this=0x7d0e80, program=0x7fff9c03fe70, callFrame=0x7fffe407efe0, thisObj=0x7fffe40bffd8)
at /home/reni/Data/REPOS/webkit_sec/Source/JavaScriptCore/interpreter/Interpreter.cpp:766
#22 0x00007ffff55e1e92 in JSC::evaluate (exec=0x7fffe407efe0, source=..., thisValue=..., returnedException=0x7fffffffcc90)
at /home/reni/Data/REPOS/webkit_sec/Source/JavaScriptCore/runtime/Completion.cpp:83
#23 0x00007ffff3f4f00d in WebCore::JSMainThreadExecState::evaluate (exec=0x7fffe407efe0, source=..., thisValue=..., exception=0x7fffffffcc90)
at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/bindings/js/JSMainThreadExecState.h:74
#24 0x00007ffff3f6da56 in WebCore::ScriptController::evaluateInWorld (this=0x7cf840, sourceCode=..., world=0x78a8b0)
at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/bindings/js/ScriptController.cpp:142
#25 0x00007ffff3f6eef5 in WebCore::ScriptController::executeScriptInWorld (this=0x7cf840, world=0x78a8b0, script=..., forceUserGesture=false)
at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/bindings/js/ScriptController.cpp:466
#26 0x00007ffff3f66ffe in WebCore::ScheduledAction::execute (this=0x935680, document=0x958860)
at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/bindings/js/ScheduledAction.cpp:134
#27 0x00007ffff3f66b7b in WebCore::ScheduledAction::execute (this=0x935680, context=0x958910)
at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/bindings/js/ScheduledAction.cpp:80
#28 0x00007ffff462380c in WebCore::DOMTimer::fired (this=0x8ec900) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/page/DOMTimer.cpp:141
#29 0x00007ffff47a4a06 in WebCore::ThreadTimers::sharedTimerFiredInternal (this=0x6ef760)
at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/platform/ThreadTimers.cpp:129
---Type <return> to continue, or q <return> to quit---
#30 0x00007ffff47a48f3 in WebCore::ThreadTimers::sharedTimerFired () at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/platform/ThreadTimers.cpp:105
#31 0x00007ffff4aabd3e in WebCore::SharedTimerQt::timerEvent (this=0x6ef7b0, ev=0x7fffffffd5b0)
at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/platform/qt/SharedTimerQt.cpp:113
#32 0x00007ffff21e766c in QObject::event(QEvent*) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5
#33 0x00007ffff302ddbc in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Widgets.so.5
#34 0x00007ffff3031075 in QApplication::notify(QObject*, QEvent*) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Widgets.so.5
#35 0x00007ffff21c1dbe in QCoreApplication::notifyInternal(QObject*, QEvent*) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5
#36 0x00007ffff220875c in QTimerInfoList::activateTimers() () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5
#37 0x00007ffff2209094 in ?? () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5
#38 0x00007fffee34a2d6 in g_main_dispatch (context=0x6632f0) at /build/buildd/glib2.0-2.37.6/./glib/gmain.c:3065
#39 g_main_context_dispatch (context=context at entry=0x6632f0) at /build/buildd/glib2.0-2.37.6/./glib/gmain.c:3641
#40 0x00007fffee34a628 in g_main_context_iterate (context=context at entry=0x6632f0, block=block at entry=1, dispatch=dispatch at entry=1, self=<optimized out>)
at /build/buildd/glib2.0-2.37.6/./glib/gmain.c:3712
#41 0x00007fffee34a6cc in g_main_context_iteration (context=0x6632f0, may_block=1) at /build/buildd/glib2.0-2.37.6/./glib/gmain.c:3773
#42 0x00007ffff22094bc in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) ()
from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5
#43 0x00007ffff21c0d3b in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5
#44 0x00007ffff21c4120 in QCoreApplication::exec() () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5
#45 0x0000000000421ba0 in launcherMain (app=...) at /home/reni/Data/REPOS/webkit_sec/Tools/QtTestBrowser/qttestbrowser.cpp:49
#46 0x0000000000423680 in main (argc=2, argv=0x7fffffffdb18) at /home/reni/Data/REPOS/webkit_sec/Tools/QtTestBrowser/qttestbrowser.cpp:318
--
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
More information about the webkit-unassigned
mailing list