[Webkit-unassigned] [Bug 127684] New: ASSERTION FAILED: insertionBlock != currentRoot

Mon Jan 27 09:11:27 PST 2014

https://bugs.webkit.org/show_bug.cgi?id=127684

           Summary: ASSERTION FAILED: insertionBlock != currentRoot
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: PC
        OS/Version: Linux
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: HTML Editing
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: hodovanmartin at gmail.com

Created an attachment (id=222330)
 --> (https://bugs.webkit.org/attachment.cgi?id=222330&action=review)
Test case

The failing test:
<body onload="
    if (document.counter)
        document.counter++;
    else 
        document.counter = 1;

    if (document.counter <= 1) {
        document.designMode='on';
        document.execCommand('selectall');
        document.execCommand('RemoveFormat');
        document.execCommand('inserthtml', false);
    }"
>
    <hr>
    <canvas>
    </canvas>
</body>

The error message:
ASSERTION FAILED: insertionBlock != currentRoot
/home/martin/Data/WebKit/Source/WebCore/editing/ReplaceSelectionCommand.cpp(1016) : virtual void WebCore::ReplaceSelectionCommand::doApply()
1   0x7ffff5c19441 WTFCrash
2   0x7ffff0b2985f WebCore::ReplaceSelectionCommand::doApply()
3   0x7ffff0ac67a8 WebCore::CompositeEditCommand::apply()
4   0x7ffff0ac65a0 WebCore::applyCommand(WTF::PassRefPtr<WebCore::CompositeEditCommand>)
5   0x7ffff0afb00b
6   0x7ffff0afc683
7   0x7ffff0affa76 WebCore::Editor::Command::execute(WTF::String const&, WebCore::Event*) const
8   0x7ffff09c523e WebCore::Document::execCommand(WTF::String const&, bool, WTF::String const&)
9   0x7ffff185aa58 WebCore::jsDocumentPrototypeFunctionExecCommand(JSC::ExecState*)
10  0x7fff9b9be0e5

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff5c19446 in WTFCrash () at /home/martin/Data/WebKit/Source/WTF/wtf/Assertions.cpp:333
333        *(int *)(uintptr_t)0xbbadbeef = 0;

The backtrace:
#1  0x00007ffff0b2985f in WebCore::ReplaceSelectionCommand::doApply (this=0xa3fde0) at /home/martin/Data/WebKit/Source/WebCore/editing/ReplaceSelectionCommand.cpp:1016
#2  0x00007ffff0ac67a8 in WebCore::CompositeEditCommand::apply (this=0xa3fde0) at /home/martin/Data/WebKit/Source/WebCore/editing/CompositeEditCommand.cpp:227
#3  0x00007ffff0ac65a0 in WebCore::applyCommand (command=...) at /home/martin/Data/WebKit/Source/WebCore/editing/CompositeEditCommand.cpp:182
#4  0x00007ffff0afb00b in WebCore::executeInsertFragment (frame=..., fragment=...) at /home/martin/Data/WebKit/Source/WebCore/editing/EditorCommand.cpp:195
#5  0x00007ffff0afc683 in WebCore::executeInsertHTML (frame=..., value=...) at /home/martin/Data/WebKit/Source/WebCore/editing/EditorCommand.cpp:508
#6  0x00007ffff0affa76 in WebCore::Editor::Command::execute (this=0x7fffffffbac0, parameter=..., triggeringEvent=0x0)
    at /home/martin/Data/WebKit/Source/WebCore/editing/EditorCommand.cpp:1740
#7  0x00007ffff09c523e in WebCore::Document::execCommand (this=0x808ab0, commandName=..., userInterface=false, value=...)
    at /home/martin/Data/WebKit/Source/WebCore/dom/Document.cpp:4220
#8  0x00007ffff185aa58 in WebCore::jsDocumentPrototypeFunctionExecCommand (exec=0x7fff8f071f40)
    at /home/martin/Data/WebKit/WebKitBuild/Debug/DerivedSources/WebCore/JSDocument.cpp:3369
#9  0x00007fff9b9be0e5 in ?? ()
#10 0x00007fff8f071f90 in ?? ()
#11 0x00007ffff5c075c1 in llint_op_call () from /home/martin/Data/WebKit/WebKitBuild/Debug/lib/libjavascriptcore_efl.so.0
#12 0x00007fff9b9be900 in ?? ()
#13 0x00000000009ee4e0 in ?? ()
#14 0x00007fff800078b0 in ?? ()
#15 0x00007fff800064a0 in ?? ()
#16 0x000000000073cd50 in ?? ()
#17 0x0000000000000000 in ?? ()

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.