[Webkit-unassigned] [Bug 127339] New: ASSERTION FAILED: s.anchorType() == Position::PositionIsAfterAnchor || !offsetIsBeforeLastNodeOffset(s.offsetInContainerNode(), s.containerNode()) in WebCore::ApplyStyleCommand::removeInlineStyle

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=127339

           Summary: ASSERTION FAILED: s.anchorType() ==
                    Position::PositionIsAfterAnchor ||
                    !offsetIsBeforeLastNodeOffset(s.offsetInContainerNode(
                    ), s.containerNode()) in
                    WebCore::ApplyStyleCommand::removeInlineStyle
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: HTML Editing
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: reni at webkit.org
                CC: koivisto at iki.fi, rniwa at webkit.org, enrica at apple.com
            Blocks: 116980


Created an attachment (id=221734)
 --> (https://bugs.webkit.org/attachment.cgi?id=221734&action=review)
Test case

The failing test:

<div>foo
    <table>
        <iframe onload="document.designMode='on';
                        document.execCommand('selectall');     
                        document.execCommand('italic');
                        document.body.innerHTML='PASS';
                        ">
</div>

Note that several dump messages are generated before we actually reach the crash.

The backtrace:

ASSERTION FAILED: s.anchorType() == Position::PositionIsAfterAnchor || !offsetIsBeforeLastNodeOffset(s.offsetInContainerNode(), s.containerNode())
/home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/ApplyStyleCommand.cpp(1154) : void WebCore::ApplyStyleCommand::removeInlineStyle(WebCore::EditingStyle*, const WebCore::Position&, const WebCore::Position&)
1   0x7ffff5c172a1 WTFCrash
2   0x7ffff0a6f6fd WebCore::ApplyStyleCommand::removeInlineStyle(WebCore::EditingStyle*, WebCore::Position const&, WebCore::Position const&)
3   0x7ffff0a6c4ca WebCore::ApplyStyleCommand::applyInlineStyle(WebCore::EditingStyle*)
4   0x7ffff0a69a37 WebCore::ApplyStyleCommand::doApply()
5   0x7ffff0a78c54 WebCore::CompositeEditCommand::apply()
6   0x7ffff0a78a4c WebCore::applyCommand(WTF::PassRefPtr<WebCore::CompositeEditCommand>)
7   0x7ffff0a9c3ea WebCore::Editor::applyStyle(WebCore::StyleProperties*, WebCore::EditAction)
8   0x7ffff0aaccd0
9   0x7ffff0aad2df
10  0x7ffff0ab0ad6
11  0x7ffff0ab1f22 WebCore::Editor::Command::execute(WTF::String const&, WebCore::Event*) const
12  0x7ffff0976ab2 WebCore::Document::execCommand(WTF::String const&, bool, WTF::String const&)
13  0x7ffff1812910 WebCore::jsDocumentPrototypeFunctionExecCommand(JSC::ExecState*)
14  0x7fff9d5640e5

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff5c172a6 in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:333
333        *(int *)(uintptr_t)0xbbadbeef = 0;
(gdb) bt
#0  0x00007ffff5c172a6 in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:333
#1  0x00007ffff0a6f6fd in WebCore::ApplyStyleCommand::removeInlineStyle (this=0x32c6f20, style=0x32ca0e0, start=..., end=...)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/ApplyStyleCommand.cpp:1154
#2  0x00007ffff0a6c4ca in WebCore::ApplyStyleCommand::applyInlineStyle (this=0x32c6f20, style=0x32ca0e0)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/ApplyStyleCommand.cpp:637
#3  0x00007ffff0a69a37 in WebCore::ApplyStyleCommand::doApply (this=0x32c6f20)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/ApplyStyleCommand.cpp:220
#4  0x00007ffff0a78c54 in WebCore::CompositeEditCommand::apply (this=0x32c6f20)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/CompositeEditCommand.cpp:227
#5  0x00007ffff0a78a4c in WebCore::applyCommand (command=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/CompositeEditCommand.cpp:182
#6  0x00007ffff0a9c3ea in WebCore::Editor::applyStyle (this=0x8de210, style=0x32bb750, editingAction=WebCore::EditActionUnspecified)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/Editor.cpp:982
#7  0x00007ffff0aaccd0 in WebCore::applyCommandToFrame (frame=..., source=WebCore::CommandFromDOM, action=WebCore::EditActionItalics, style=0x32bb750)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/EditorCommand.cpp:110
#8  0x00007ffff0aad2df in WebCore::executeToggleStyle (frame=..., source=WebCore::CommandFromDOM, action=WebCore::EditActionItalics, 
    propertyID=WebCore::CSSPropertyFontStyle, offValue=0x7ffff208a14c "normal", onValue=0x7ffff208a153 "italic")
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/EditorCommand.cpp:171
#9  0x00007ffff0ab0ad6 in WebCore::executeToggleItalic (frame=..., source=WebCore::CommandFromDOM)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/EditorCommand.cpp:1119
#10 0x00007ffff0ab1f22 in WebCore::Editor::Command::execute (this=0x7fffff823d90, parameter=..., triggeringEvent=0x0)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/EditorCommand.cpp:1740
#11 0x00007ffff0976ab2 in WebCore::Document::execCommand (this=0x11c7e40, commandName=..., userInterface=false, value=...)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Document.cpp:4220
#12 0x00007ffff1812910 in WebCore::jsDocumentPrototypeFunctionExecCommand (exec=0x7fff93d6c680)
    at /home/reni/Data/REPOS/webkit_sec/WebKitBuild/Debug/DerivedSources/WebCore/JSDocument.cpp:3369
#13 0x00007fff9d5640e5 in ?? ()
#14 0x00007fff93d6c6d0 in ?? ()
#15 0x00007fffdd563a65 in ?? ()
#16 0x00007fffdd5638a0 in ?? ()
#17 0x0000000001141730 in ?? ()
#18 0x0000000000000001 in ?? ()
#19 0x0000000000000001 in ?? ()
#20 0x0000000001109320 in ?? ()
#21 0x0000000000000000 in ?? ()

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.