[Webkit-unassigned] [Bug 141031] New: ASSERTION FAILED: baseStringPos[0] == '/' in WebCore::copyPathRemovingDots

Thu Jan 29 06:19:55 PST 2015

https://bugs.webkit.org/show_bug.cgi?id=141031

            Bug ID: 141031
           Summary: ASSERTION FAILED: baseStringPos[0] == '/' in
                    WebCore::copyPathRemovingDots
    Classification: Unclassified
           Product: WebKit
           Version: 528+ (Nightly build)
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebCore Misc.
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: rhodovan.u-szeged at partner.samsung.com
                CC: ap at webkit.org, darin at apple.com, mitz at webkit.org
            Blocks: 116980

Created attachment 245617
  --> https://bugs.webkit.org/attachment.cgi?id=245617&action=review
Test case

Load this test with debug WK:

<!DOCTYPE html>
<img longdesc="|">
<base href="file:a:&#47"></base>
<script>
    document.execCommand("selectAll");
</script>

Note: it requires HTTP.

Backtrace:

ASSERTION FAILED: baseStringPos[0] == '/'
../../Source/WebCore/platform/URL.cpp(929) : int WebCore::copyPathRemovingDots(char*, const char*, int, int)

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fff8affd700 (LWP 17902)]
0x00007fffed72443d in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321
321        *(int *)(uintptr_t)0xbbadbeef = 0;
#0  0x00007fffed72443d in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321
#1  0x00007ffff35d5d9e in WebCore::copyPathRemovingDots (dst=0x7fffffffadf7 "", src=0x7fffffffb007 "a:/\005", srcStart=0, srcEnd=3) at ../../Source/WebCore/platform/URL.cpp:929
#2  0x00007ffff35d32ac in WebCore::URL::init (this=0x7fffffffb300, base=..., relative=..., encoding=...) at ../../Source/WebCore/platform/URL.cpp:499
#3  0x00007ffff35d283a in WebCore::URL::URL (this=0x7fffffffb300, base=..., relative=..., encoding=...) at ../../Source/WebCore/platform/URL.cpp:345
#4  0x00007ffff2eccb6f in WebCore::Document::completeURL (this=0x7fff98522000, url=..., baseURLOverride=...) at ../../Source/WebCore/dom/Document.cpp:4184
#5  0x00007ffff2eccba9 in WebCore::Document::completeURL (this=0x7fff98522000, url=...) at ../../Source/WebCore/dom/Document.cpp:4189
#6  0x00007ffff3063d11 in WebCore::MarkupAccumulator::resolveURLIfNeeded (this=0x7fffffffb9f0, element=..., urlString=...) at ../../Source/WebCore/editing/MarkupAccumulator.cpp:180
#7  0x00007ffff3063fdf in WebCore::MarkupAccumulator::appendQuotedURLAttributeValue (this=0x7fffffffb9f0, result=..., element=..., attribute=...) at ../../Source/WebCore/editing/MarkupAccumulator.cpp:232
#8  0x00007ffff30659d3 in WebCore::MarkupAccumulator::appendAttribute (this=0x7fffffffb9f0, result=..., element=..., attribute=..., namespaces=0x0) at ../../Source/WebCore/editing/MarkupAccumulator.cpp:527
#9  0x00007ffff30b5849 in WebCore::StyledMarkupAccumulator::appendElement (this=0x7fffffffb9f0, out=..., element=..., addDisplayInline=false, rangeFullySelectsNode=WebCore::StyledMarkupAccumulator::DoesFullySelectNode) at ../../Source/WebCore/editing/markup.cpp:307
#10 0x00007ffff30ba925 in WebCore::StyledMarkupAccumulator::appendElement (this=0x7fffffffb9f0, out=..., element=...) at ../../Source/WebCore/editing/markup.cpp:142
#11 0x00007ffff3065d43 in WebCore::MarkupAccumulator::appendStartMarkup (this=0x7fffffffb9f0, result=..., node=..., namespaces=0x0) at ../../Source/WebCore/editing/MarkupAccumulator.cpp:570
#12 0x00007ffff3063dec in WebCore::MarkupAccumulator::appendStartTag (this=0x7fffffffb9f0, node=..., namespaces=0x0) at ../../Source/WebCore/editing/MarkupAccumulator.cpp:196
#13 0x00007ffff30b5eec in WebCore::StyledMarkupAccumulator::traverseNodesForSerialization (this=0x7fffffffb9f0, startNode=0x7ffff7f31900, pastEnd=0x7ffff7f12640, traversalMode=WebCore::StyledMarkupAccumulator::EmitString) at ../../Source/WebCore/editing/markup.cpp:395
#14 0x00007ffff30b5d0c in WebCore::StyledMarkupAccumulator::serializeNodes (this=0x7fffffffb9f0, startNode=0x7ffff7f31900, pastEnd=0x7ffff7f12640) at ../../Source/WebCore/editing/markup.cpp:362
#15 0x00007ffff30b7364 in WebCore::createMarkupInternal (document=..., range=..., nodes=0x0, shouldAnnotate=WebCore::AnnotateForInterchange, convertBlocksToInlines=false, shouldResolveURLs=WebCore::ResolveNonLocalURLs) at ../../Source/WebCore/editing/markup.cpp:596
#16 0x00007ffff30b7cf1 in WebCore::createMarkup (range=..., nodes=0x0, shouldAnnotate=WebCore::AnnotateForInterchange, convertBlocksToInlines=false, shouldResolveURLs=WebCore::ResolveNonLocalURLs) at ../../Source/WebCore/editing/markup.cpp:650
#17 0x00007ffff298ee28 in WebKit::WebEditorClient::updateGlobalSelection (this=0x6066b0, frame=0x7ffff7f37a00) at ../../Source/WebKit2/WebProcess/WebCoreSupport/gtk/WebEditorClientGtk.cpp:195
#18 0x00007ffff2847b3e in WebKit::WebEditorClient::respondToChangedSelection (this=0x6066b0, frame=0x7ffff7f37a00) at ../../Source/WebKit2/WebProcess/WebCoreSupport/WebEditorClient.cpp:189
#19 0x00007ffff3038635 in WebCore::Editor::respondToChangedSelection (this=0x607830, options=7) at ../../Source/WebCore/editing/Editor.cpp:3247
#20 0x00007ffff3049180 in WebCore::FrameSelection::setSelectionWithoutUpdatingAppearance (this=0x7ffff7f31c60, newSelectionPossiblyWithoutDirection=..., options=7, align=WebCore::FrameSelection::AlignCursorOnScrollIfNeeded, granularity=WebCore::CharacterGranularity) at ../../Source/WebCore/editing/FrameSelection.cpp:317
#21 0x00007ffff3049304 in WebCore::FrameSelection::setSelection (this=0x7ffff7f31c60, selection=..., options=7, align=WebCore::FrameSelection::AlignCursorOnScrollIfNeeded, granularity=WebCore::CharacterGranularity) at ../../Source/WebCore/editing/FrameSelection.cpp:325
#22 0x00007ffff30520e4 in WebCore::FrameSelection::selectAll (this=0x7ffff7f31c60) at ../../Source/WebCore/editing/FrameSelection.cpp:1711
#23 0x00007ffff3041f56 in WebCore::executeSelectAll (frame=...) at ../../Source/WebCore/editing/EditorCommand.cpp:1019
#24 0x00007ffff3043c33 in WebCore::Editor::Command::execute (this=0x7fffffffbf20, parameter=..., triggeringEvent=0x0) at ../../Source/WebCore/editing/EditorCommand.cpp:1726
#25 0x00007ffff2ecd75c in WebCore::Document::execCommand (this=0x7fff98522000, commandName=..., userInterface=false, value=...) at ../../Source/WebCore/dom/Document.cpp:4389
#26 0x00007ffff3f36ca0 in WebCore::jsDocumentPrototypeFunctionExecCommand (exec=0x7fffffffc020) at DerivedSources/WebCore/JSDocument.cpp:4545
#27 0x00007fff99d500a8 in ?? ()
#28 0x00007fffffffc070 in ?? ()
#29 0x00007fffed6d3ca8 in llint_entry () from /home/reni/data/REPOS/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20150129/c499f18e/attachment-0002.html>