[Webkit-unassigned] [Bug 150236] New: ASSERTION FAILED: renderer() in WebCore::HTMLTextAreaElement::updateValue

Fri Oct 16 09:59:11 PDT 2015

https://bugs.webkit.org/show_bug.cgi?id=150236

            Bug ID: 150236
           Summary: ASSERTION FAILED: renderer() in
                    WebCore::HTMLTextAreaElement::updateValue
    Classification: Unclassified
           Product: WebKit
           Version: WebKit Local Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: HTML Editing
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: rhodovan.u-szeged at partner.samsung.com
                CC: darin at apple.com, mrowe at bdash.net.nz
            Blocks: 116980

Created attachment 263277
  --> https://bugs.webkit.org/attachment.cgi?id=263277&action=review
Test

Load this with debug WebKit:

<!DOCTYPE html>
<textarea autofocus></textarea>
<script>
    document.designMode = 'on';
    document.execCommand("selectAll", false, null);
</script>
<body hidden>
<li>
<script>
    document.execCommand("selectAll", false, null);
    document.execCommand("cut", true , null);
    document.execCommand("insertParagraph", true , null);
</script>

Backtrace:

ASSERTION FAILED: renderer()
../../Source/WebCore/html/HTMLTextAreaElement.cpp(341) : void WebCore::HTMLTextAreaElement::updateValue() const

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fff8effd700 (LWP 27716)]
0x00007fffec497eda in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321
321        *(int *)(uintptr_t)0xbbadbeef = 0;
(gdb) bt
#0  0x00007fffec497eda in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321
#1  0x00007ffff2bf0a0e in WebCore::HTMLTextAreaElement::updateValue (this=0x7fffd5bb6000) at ../../Source/WebCore/html/HTMLTextAreaElement.cpp:341
#2  0x00007ffff2bf0ace in WebCore::HTMLTextAreaElement::value (this=0x7fffd5bb6000) at ../../Source/WebCore/html/HTMLTextAreaElement.cpp:351
#3  0x00007ffff2bf14c6 in WebCore::HTMLTextAreaElement::tooLong (this=0x7fffd5bb6000) at ../../Source/WebCore/html/HTMLTextAreaElement.cpp:466
#4  0x00007ffff2b2d593 in WebCore::FormAssociatedElement::valid (this=0x7fffd5bb6068) at ../../Source/WebCore/html/FormAssociatedElement.cpp:218
#5  0x00007ffff2b6ac91 in WebCore::HTMLFormControlElement::updateValidity (this=0x7fffd5bb6000) at ../../Source/WebCore/html/HTMLFormControlElement.cpp:497
#6  0x00007ffff2bf0503 in WebCore::HTMLTextAreaElement::subtreeHasChanged (this=0x7fffd5bb6000) at ../../Source/WebCore/html/HTMLTextAreaElement.cpp:282
#7  0x00007ffff2bf2e97 in WebCore::HTMLTextFormControlElement::didEditInnerTextValue (this=0x7fffd5bb6000)
    at ../../Source/WebCore/html/HTMLTextFormControlElement.cpp:111
#8  0x00007ffff2a5fdd7 in WebCore::notifyTextFromControls (startRoot=0x7fffd5be24e0, endRoot=0x7fffd5be24e0) at ../../Source/WebCore/editing/Editor.cpp:1002
#9  0x00007ffff2a6018b in WebCore::Editor::appliedEditing (this=0x7fffd5aec000, cmd=...) at ../../Source/WebCore/editing/Editor.cpp:1025
#10 0x00007ffff2acf0c0 in WebCore::TypingCommand::typingAddedToOpenCommand (this=0x7fffd5aa4000, 
    commandTypeForAddedTyping=WebCore::TypingCommand::InsertParagraphSeparator) at ../../Source/WebCore/editing/TypingCommand.cpp:359
#11 0x00007ffff2acf45e in WebCore::TypingCommand::insertParagraphSeparator (this=0x7fffd5aa4000) at ../../Source/WebCore/editing/TypingCommand.cpp:399
#12 0x00007ffff2acebcc in WebCore::TypingCommand::doApply (this=0x7fffd5aa4000) at ../../Source/WebCore/editing/TypingCommand.cpp:275
#13 0x00007ffff2a2bd72 in WebCore::CompositeEditCommand::apply (this=0x7fffd5aa4000) at ../../Source/WebCore/editing/CompositeEditCommand.cpp:229
#14 0x00007ffff2a2bb23 in WebCore::applyCommand (command=...) at ../../Source/WebCore/editing/CompositeEditCommand.cpp:188
#15 0x00007ffff2ace7de in WebCore::TypingCommand::insertParagraphSeparator (document=..., options=0) at ../../Source/WebCore/editing/TypingCommand.cpp:222
#16 0x00007ffff2a76a1c in WebCore::executeInsertParagraph (frame=...) at ../../Source/WebCore/editing/EditorCommand.cpp:524
#17 0x00007ffff2a7a5ca in WebCore::Editor::Command::execute (this=0x7fffffffb920, parameter=..., triggeringEvent=0x0)
    at ../../Source/WebCore/editing/EditorCommand.cpp:1704
#18 0x00007ffff28df7f7 in WebCore::Document::execCommand (this=0x7fffd581ea00, commandName=..., userInterface=true, value=...)
    at ../../Source/WebCore/dom/Document.cpp:4657
#19 0x00007ffff3a87d9f in WebCore::jsDocumentPrototypeFunctionExecCommand (state=0x7fffffffb9f0) at DerivedSources/WebCore/JSDocument.cpp:5101
#20 0x00007fff953e00c8 in ?? ()
#21 0x00007fffffffba70 in ?? ()
#22 0x00007fffec440591 in llint_entry () from /home/reni/data/REPOS/fuzztargets/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20151016/796201bc/attachment-0001.html>