[Webkit-unassigned] [Bug 130844] New: ASSERTION FAILED: candidate.isCandidate() in WebCore::canonicalizeCandidate

Thu Mar 27 10:00:26 PDT 2014

https://bugs.webkit.org/show_bug.cgi?id=130844

           Summary: ASSERTION FAILED: candidate.isCandidate() in
                    WebCore::canonicalizeCandidate
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: HTML Editing
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: rhodovan.u-szeged at partner.samsung.com
                CC: darin at apple.com, oliver at apple.com, rniwa at webkit.org,
                    akling at apple.com
            Blocks: 116980

Created an attachment (id=227952)
 --> (https://bugs.webkit.org/attachment.cgi?id=227952&action=review)
Test case

The test hits the assertion:

<body contenteditable="true">
  <fieldset>
    <sup contenteditable="false">
      <svg>
    <polyline onload='document.execCommand("selectall", true, null)'>

The related backtrace:

ASSERTION FAILED: candidate.isCandidate()
/home/reni2/data/REPOS/webkit_sec/Source/WebCore/editing/VisiblePosition.cpp(496) : WebCore::Position WebCore::canonicalizeCandidate(const WebCore::Position&)
1   0x7ffff5ed9db5 WTFCrash
2   0x7ffff10e6977
3   0x7ffff10e6b8a WebCore::VisiblePosition::canonicalPosition(WebCore::Position const&)
4   0x7ffff10e4a8d WebCore::VisiblePosition::init(WebCore::Position const&, WebCore::EAffinity)
5   0x7ffff10e4a53 WebCore::VisiblePosition::VisiblePosition(WebCore::Position const&, WebCore::EAffinity)
6   0x7ffff10e8adc WebCore::VisibleSelection::setBaseAndExtentToDeepEquivalents()
7   0x7ffff10e9b57 WebCore::VisibleSelection::validate(WebCore::TextGranularity)
8   0x7ffff10e7cac WebCore::VisibleSelection::VisibleSelection(WebCore::Position const&, WebCore::Position const&, WebCore::EAffinity, bool)
9   0x7ffff10e7f15 WebCore::VisibleSelection::selectionFromContentsOfNode(WebCore::Node*)
10  0x7ffff10a9f5c WebCore::FrameSelection::selectAll()
11  0x7ffff109d15e
12  0x7ffff109eb24 WebCore::Editor::Command::execute(WTF::String const&, WebCore::Event*) const
13  0x7ffff0f58f4c WebCore::Document::execCommand(WTF::String const&, bool, WTF::String const&)
14  0x7ffff1f340fb WebCore::jsDocumentPrototypeFunctionExecCommand(JSC::ExecState*)
15  0x7fff9b6ce0b4

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff5ed9dba in WTFCrash () at /home/reni2/data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:333
333        *(int *)(uintptr_t)0xbbadbeef = 0;
(gdb) ERR<26821>:eet eet_lib.c:668 eet_shutdown() File '/home/reni2/.cache/efreet/icon_themes_reni2.eet' is still open !
bt
#0  0x00007ffff5ed9dba in WTFCrash () at /home/reni2/data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:333
#1  0x00007ffff10e6977 in WebCore::canonicalizeCandidate (candidate=...)
    at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/editing/VisiblePosition.cpp:496
#2  0x00007ffff10e6b8a in WebCore::VisiblePosition::canonicalPosition (this=0x7fffffffb290, passedPosition=...)
    at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/editing/VisiblePosition.cpp:533
#3  0x00007ffff10e4a8d in WebCore::VisiblePosition::init (this=0x7fffffffb290, position=..., 
    affinity=WebCore::DOWNSTREAM) at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/editing/VisiblePosition.cpp:58
#4  0x00007ffff10e4a53 in WebCore::VisiblePosition::VisiblePosition (this=0x7fffffffb290, pos=..., 
    affinity=WebCore::DOWNSTREAM) at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/editing/VisiblePosition.cpp:51
#5  0x00007ffff10e8adc in WebCore::VisibleSelection::setBaseAndExtentToDeepEquivalents (this=0x7fffffffb3b0)
    at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/editing/VisibleSelection.cpp:257
#6  0x00007ffff10e9b57 in WebCore::VisibleSelection::validate (this=0x7fffffffb3b0, 
    granularity=WebCore::CharacterGranularity)
    at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/editing/VisibleSelection.cpp:427
#7  0x00007ffff10e7cac in WebCore::VisibleSelection::VisibleSelection (this=0x7fffffffb3b0, base=..., extent=..., 
    affinity=WebCore::DOWNSTREAM, isDirectional=false)
    at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/editing/VisibleSelection.cpp:66
#8  0x00007ffff10e7f15 in WebCore::VisibleSelection::selectionFromContentsOfNode (node=0x9b8ec0)
    at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/editing/VisibleSelection.cpp:99
#9  0x00007ffff10a9f5c in WebCore::FrameSelection::selectAll (this=0x8a0b40)
    at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/editing/FrameSelection.cpp:1690
#10 0x00007ffff109d15e in WebCore::executeSelectAll (frame=...)
    at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/editing/EditorCommand.cpp:1021
#11 0x00007ffff109eb24 in WebCore::Editor::Command::execute (this=0x7fffffffb4b0, parameter=..., triggeringEvent=
    0x0) at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/editing/EditorCommand.cpp:1741
#12 0x00007ffff0f58f4c in WebCore::Document::execCommand (this=0x8cfd40, commandName=..., userInterface=true, 
    value=...) at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/dom/Document.cpp:4217
#13 0x00007ffff1f340fb in WebCore::jsDocumentPrototypeFunctionExecCommand (exec=0x7fffffffb5b0)
    at /home/reni2/data/REPOS/webkit_sec/WebKitBuild/Debug/DerivedSources/WebCore/JSDocument.cpp:4736
#14 0x00007fff9b6ce0b4 in ?? ()
#15 0x00007fffffffb610 in ?? ()
#16 0x00007ffff5ec4fb5 in llint_op_call ()
   from /home/reni2/data/REPOS/webkit_sec/WebKitBuild/Debug/lib/libjavascriptcore_efl.so.0
#17 0x0000000000000000 in ?? ()

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.