[Webkit-unassigned] [Bug 127342] New: ASSERTION FAILED: node == end.deprecatedNode() || !node->contains(end.deprecatedNode()) in WebCore::ApplyStyleCommand::removeInlineStyle

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=127342

           Summary: ASSERTION FAILED: node == end.deprecatedNode() ||
                    !node->contains(end.deprecatedNode()) in
                    WebCore::ApplyStyleCommand::removeInlineStyle
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: PC
        OS/Version: Linux
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: HTML Editing
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: reni at webkit.org
                CC: sam at webkit.org, koivisto at iki.fi, rniwa at webkit.org
            Blocks: 116980


Created an attachment (id=221737)
 --> (https://bugs.webkit.org/attachment.cgi?id=221737&action=review)
Test case

The test:

<applet code="applet1.class">foo
    <small>
    <iframe onload="document.designMode='on';     
                    document.execCommand('selectall');     
                    document.execCommand('italic');     
                    document.execCommand('RemoveFormat');"
            seamless></iframe>
</applet>


The backtrace:

ASSERTION FAILED: node == end.deprecatedNode() || !node->contains(end.deprecatedNode())
/home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/ApplyStyleCommand.cpp(1126) : void WebCore::ApplyStyleCommand::removeInlineStyle(WebCore::EditingStyle*, const WebCore::Position&, const WebCore::Position&)
1   0x7ffff5c172a1 WTFCrash
2   0x7ffff0a6f36c WebCore::ApplyStyleCommand::removeInlineStyle(WebCore::EditingStyle*, WebCore::Position const&, WebCore::Position const&)
3   0x7ffff0a6c4ca WebCore::ApplyStyleCommand::applyInlineStyle(WebCore::EditingStyle*)
4   0x7ffff0a69a37 WebCore::ApplyStyleCommand::doApply()
5   0x7ffff0a78e94 WebCore::CompositeEditCommand::applyCommandToComposite(WTF::PassRefPtr<WebCore::EditCommand>)
6   0x7ffff0ad42c5 WebCore::RemoveFormatCommand::doApply()
7   0x7ffff0a78c54 WebCore::CompositeEditCommand::apply()
8   0x7ffff0a78a4c WebCore::applyCommand(WTF::PassRefPtr<WebCore::CompositeEditCommand>)
9   0x7ffff0a9c041 WebCore::Editor::removeFormattingAndStyle()
10  0x7ffff0ab03db
11  0x7ffff0ab1f22 WebCore::Editor::Command::execute(WTF::String const&, WebCore::Event*) const
12  0x7ffff0976ab2 WebCore::Document::execCommand(WTF::String const&, bool, WTF::String const&)
13  0x7ffff1812910 WebCore::jsDocumentPrototypeFunctionExecCommand(JSC::ExecState*)
14  0x7fff9d5640e5

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff5c172a6 in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:333
333        *(int *)(uintptr_t)0xbbadbeef = 0;
(gdb) bt
#0  0x00007ffff5c172a6 in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:333
#1  0x00007ffff0a6f36c in WebCore::ApplyStyleCommand::removeInlineStyle (this=0x12000a0, style=0x12230f0, start=..., end=...)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/ApplyStyleCommand.cpp:1126
#2  0x00007ffff0a6c4ca in WebCore::ApplyStyleCommand::applyInlineStyle (this=0x12000a0, style=0x12230f0)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/ApplyStyleCommand.cpp:637
#3  0x00007ffff0a69a37 in WebCore::ApplyStyleCommand::doApply (this=0x12000a0)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/ApplyStyleCommand.cpp:220
#4  0x00007ffff0a78e94 in WebCore::CompositeEditCommand::applyCommandToComposite (this=0x1200b90, prpCommand=...)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/CompositeEditCommand.cpp:278
#5  0x00007ffff0ad42c5 in WebCore::RemoveFormatCommand::doApply (this=0x1200b90)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/RemoveFormatCommand.cpp:92
#6  0x00007ffff0a78c54 in WebCore::CompositeEditCommand::apply (this=0x1200b90)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/CompositeEditCommand.cpp:227
#7  0x00007ffff0a78a4c in WebCore::applyCommand (command=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/CompositeEditCommand.cpp:182
#8  0x00007ffff0a9c041 in WebCore::Editor::removeFormattingAndStyle (this=0x750200) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/Editor.cpp:914
#9  0x00007ffff0ab03db in WebCore::executeRemoveFormat (frame=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/EditorCommand.cpp:985
#10 0x00007ffff0ab1f22 in WebCore::Editor::Command::execute (this=0x7fffffff9ad0, parameter=..., triggeringEvent=0x0)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/editing/EditorCommand.cpp:1740
#11 0x00007ffff0976ab2 in WebCore::Document::execCommand (this=0x11c8ad0, commandName=..., userInterface=false, value=...)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Document.cpp:4220
#12 0x00007ffff1812910 in WebCore::jsDocumentPrototypeFunctionExecCommand (exec=0x7fff93d8bf40)
    at /home/reni/Data/REPOS/webkit_sec/WebKitBuild/Debug/DerivedSources/WebCore/JSDocument.cpp:3369
#13 0x00007fff9d5640e5 in ?? ()
#14 0x00007fff93d8bf90 in ?? ()
#15 0x00007ffff5c05421 in llint_op_call () from /home/reni/Data/REPOS/webkit_sec/WebKitBuild/Debug/lib/libjavascriptcore_efl.so.0
#16 0x00007fff9d564900 in ?? ()
#17 0x0000000001141e20 in ?? ()
#18 0x0000000000000001 in ?? ()
#19 0x0000000000000001 in ?? ()
#20 0x00000000011596b0 in ?? ()
#21 0x0000000000000000 in ?? ()

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.