[Webkit-unassigned] [Bug 161947] New: [GTK] SIGSEGV at WebCore::Node::lastDescendant in editing/inserting/insert-table-in-paragraph-crash.html

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=161947

            Bug ID: 161947
           Summary: [GTK] SIGSEGV at WebCore::Node::lastDescendant in
                    editing/inserting/insert-table-in-paragraph-crash.html
    Classification: Unclassified
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebKit Gtk
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: Hironori.Fujii at sony.com
                CC: bugs-noreply at webkitgtk.org

Created attachment 288773
  --> https://bugs.webkit.org/attachment.cgi?id=288773&action=review
crash-replacing-list-by-list-crash-log.txt

[GTK] SIGSEGV at WebCore::Node::lastDescendant in editing/inserting/insert-table-in-paragraph-crash.html

trunk at 205856
Fedora 24, VMWare

Debug build does not crash on my Linux box.
BuildBot does not crash both in debug and release build.

> ./Tools/Scripts/run-webkit-tests --gtk --release --no-new-test-results editing/inserting/insert-table-in-paragraph-crash.html

> Thread 1 (Thread 0x7fb595cf7a80 (LWP 81204)):
> #0  0x00007fb593f44c10 in WebCore::Node::lastDescendant() const () from /home/fujii/work/webkit/w1/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
> #1  0x00007fb5940161b8 in WebCore::ReplaceSelectionCommand::removeUnrenderedTextNodesAtEnds(WebCore::ReplaceSelectionCommand::InsertedNodes&) () from /home/fujii/work/webkit/w1/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
> #2  0x00007fb59401c508 in WebCore::ReplaceSelectionCommand::doApply() () from /home/fujii/work/webkit/w1/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
> #3  0x00007fb593fa9e43 in WebCore::CompositeEditCommand::apply() () from /home/fujii/work/webkit/w1/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
> #4  0x00007fb593fe1f8b in WebCore::executeInsertHTML(WebCore::Frame&, WebCore::Event*, WebCore::EditorCommandSource, WTF::String const&) () from /home/fujii/work/webkit/w1/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
> #5  0x00007fb593ee9322 in WebCore::Document::execCommand(WTF::String const&, bool, WTF::String const&) () from /home/fujii/work/webkit/w1/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
> #6  0x00007fb594c0d73b in WebCore::jsDocumentPrototypeFunctionExecCommand(JSC::ExecState*) () from /home/fujii/work/webkit/w1/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
> #7  0x00007fb53b1ff028 in ?? ()
> #8  0x00007ffda02ef4a0 in ?? ()
> #9  0x00007fb591f21d6f in llint_entry () from /home/fujii/work/webkit/w1/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
> Backtrace stopped: frame did not save the PC

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160914/8462b806/attachment-0001.html>