[Webkit-unassigned] [Bug 154905] New: WebKit assert in WebCore::VisiblePosition::previous() displaying youtube video

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=154905

            Bug ID: 154905
           Summary: WebKit assert in WebCore::VisiblePosition::previous()
                    displaying youtube video
    Classification: Unclassified
           Product: WebKit
           Version: Other
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: HTML Editing
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: richcoe2 at gmail.com

I've been facing core dumps in the application liferea for a long time (months) that was always in WebKit javascript library, but because debug was not available I did not have more information.

WebKit version 2.4.9  Linux x86_64  

It reproduces fairly often, so I finally got around to compiling a debug version to get a proper traceback to the issue.   This is my first results with debug.

When I view video's from youtube embedded in a displayed web page, I get a crash.  Sometimes it happens after viewing 3 or 4 videos, sometimes after viewing only one.

In this instance, I had just started the application and had finished watching a short video. 
I restarted the video from the beginning and then clicked on video itself.

ASSERTION FAILED: prev != *this
../../Source/WebCore/editing/VisiblePosition.cpp(89) : WebCore::VisiblePosition WebCore::VisiblePosition::previous(WebCore::EditingBoundaryCrossingRule) const

#0  0x00007fae13530f47 in WTFCrash() () at ../../Source/WTF/wtf/Assertions.cpp:333
#1  0x00007fae15ece33b in WebCore::VisiblePosition::previous(WebCore::EditingBoundaryCrossingRule) const (this=0x7fff3dd371b0, rule=WebCore::CanCrossEditingBoundary) at ../../Source/WebCore/editing/VisiblePosition.cpp:89
#2  0x00007fae15edb0d4 in WebCore::isStartOfDocument(WebCore::VisiblePosition const&) (p=...)
    at ../../Source/WebCore/editing/VisibleUnits.cpp:1411
#3  0x00007fae15e846ef in WebCore::FrameSelection::selectFrameElementInParentIfFullySelected() (this=0x336b580)
    at ../../Source/WebCore/editing/FrameSelection.cpp:1638
#4  0x00007fae15e7dbad in WebCore::FrameSelection::setSelection(WebCore::VisibleSelection const&, unsigned int, WebCore::FrameSelection::CursorAlignOnScroll, WebCore::TextGranularity) (this=0x336b580, newSelection=..., options=6, align=WebCore::FrameSelection::AlignCursorOnScrollIfNeeded, granularity=WebCore::CharacterGranularity)
    at ../../Source/WebCore/editing/FrameSelection.cpp:322
#5  0x00007fae162d0c46 in WebCore::DOMSelection::addRange(WebCore::Range*) (this=0x49ddfb0, r=0x3d6d170)
    at ../../Source/WebCore/page/DOMSelection.cpp:395
#6  0x00007fae167c7e68 in WebCore::jsDOMSelectionPrototypeFunctionAddRange(JSC::ExecState*) (exec=0x7fad9c5d6e10) at DerivedSources/WebCore/JSDOMSelection.cpp:476
#7  0x00007fadabfff0e5 in  ()
#8  0x00007fad9c5d6e60 in  ()
#9  0x00007fae13327981 in llint_op_call () at /usr/local/lib64/libjavascriptcoregtk-3.0.so.0
#10 0x00007fadabfff920 in  ()
#11 0x000000000261b4f0 in  ()
Python Exception <type 'exceptions.OverflowError'> long too big to convert: 
Python Exception <type 'exceptions.OverflowError'> long too big to convert: 
#12 0xffffffffffffffff in  ()
#13 0xffffffffffffffff in  ()
#14 0x0000000001a19e10 in  ()
#15 0x0000000000000000 in  ()

(gdb) up
#1  0x00007fae15ece33b in WebCore::VisiblePosition::previous (this=0x7fff3dd371b0, 
    rule=WebCore::CanCrossEditingBoundary) at ../../Source/WebCore/editing/VisiblePosition.cpp:89
89          ASSERT(prev != *this);
(gdb) p prev
$1 = {m_deepPosition = {m_anchorNode = {m_ptr = 0x3fb7220}, m_offset = 0, m_anchorType = 0, 
    m_isLegacyEditingPosition = true}, m_affinity = WebCore::DOWNSTREAM}
(gdb) print this
$2 = (const WebCore::VisiblePosition * const) 0x7fff3dd371b0
(gdb) p &prev
$3 = (WebCore::VisiblePosition *) 0x7fff3dd37080
(gdb) p *this
$4 = {m_deepPosition = {m_anchorNode = {m_ptr = 0x3fb7220}, m_offset = 0, m_anchorType = 0, 
    m_isLegacyEditingPosition = true}, m_affinity = WebCore::DOWNSTREAM}
(gdb) p pos
$5 = {m_anchorNode = {m_ptr = 0x2114740}, m_offset = 0, m_anchorType = 0, m_isLegacyEditingPosition = true}

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160302/384b263c/attachment-0001.html>