[Webkit-unassigned] [Bug 175923] New: Debug assertion in Position::Position (!m_anchorNode || !m_anchorNode->isPseudoElement())

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=175923

            Bug ID: 175923
           Summary: Debug assertion in Position::Position (!m_anchorNode
                    || !m_anchorNode->isPseudoElement())
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: HTML Editing
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: wenson_hsieh at apple.com
                CC: wenson_hsieh at apple.com

Test case: load the following HTML:

```
<code style="color: green">PASS</code>
<canvas style="-webkit-user-modify: read-write"><input id="input"></canvas>
<script>
if (window.testRunner)
    testRunner.dumpAsText();
input.focus();
input.remove();
document.execCommand("ForwardDelete");
</script>
```

...and observe an assertion like this:

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.JavaScriptCore            0x0000000109518c27 WTFCrash + 39 (Assertions.cpp:278)
1   com.apple.WebCore                   0x0000000112e51747 WebCore::Position::Position(WebCore::Node*, int, WebCore::Position::AnchorType) + 183 (Position.cpp:130)
2   com.apple.WebCore                   0x0000000112e51819 WebCore::Position::Position(WebCore::Node*, int, WebCore::Position::AnchorType) + 41 (Position.cpp:133)
3   com.apple.WebCore                   0x0000000110cd62bc WebCore::positionInParentBeforeNode(WebCore::Node const*) + 124 (Position.h:266)
4   com.apple.WebCore                   0x0000000111570f2e WebCore::updatePositionForNodeRemoval(WebCore::Position&, WebCore::Node&) + 270 (Editing.cpp:960)
5   com.apple.WebCore                   0x00000001117f9dba WebCore::FrameSelection::respondToNodeModification(WebCore::Node&, bool, bool, bool, bool) + 170 (FrameSelection.cpp:472)
6   com.apple.WebCore                   0x00000001117f9cdd WebCore::FrameSelection::nodeWillBeRemoved(WebCore::Node&) + 349 (FrameSelection.cpp:458)
7   com.apple.WebCore                   0x000000011141b3a8 WebCore::Document::nodeWillBeRemoved(WebCore::Node&) + 584 (Document.cpp:4075)
8   com.apple.WebCore                   0x000000011103ece8 WebCore::ContainerNode::removeChild(WebCore::Node&) + 456 (ContainerNode.cpp:544)
9   com.apple.WebCore                   0x0000000112d2a4ad WebCore::Node::remove() + 109 (Node.cpp:565)
10  com.apple.WebCore                   0x000000011215a0cd WebCore::jsElementPrototypeFunctionRemoveBody(JSC::ExecState*, WebCore::JSElement*, JSC::ThrowScope&) + 77 (JSElement.cpp:2641)
11  com.apple.WebCore                   0x0000000112152717 long long WebCore::IDLOperation<WebCore::JSElement>::call<&(WebCore::jsElementPrototypeFunctionRemoveBody(JSC::ExecState*, WebCore::JSElement*, JSC::ThrowScope&)), (WebCore::CastedThisErrorBehavior)0>(JSC::ExecState&, char const*) + 615 (JSDOMOperation.h:53)
12  com.apple.WebCore                   0x000000011214595c WebCore::jsElementPrototypeFunctionRemove(JSC::ExecState*) + 28 (JSElement.cpp:2647)
13  ???                                 0x00005c9ab8001028 0 + 101819581730856
14  com.apple.JavaScriptCore            0x00000001090853d6 llint_entry + 31248
15  com.apple.JavaScriptCore            0x000000010907d7a7 vmEntryToJavaScript + 343
16  com.apple.JavaScriptCore            0x0000000108e4bc21 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 353 (JITCode.cpp:81)
17  com.apple.JavaScriptCore            0x0000000108df8853 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::ExecState*, JSC::JSObject*) + 5283 (Interpreter.cpp:912)
18  com.apple.JavaScriptCore            0x0000000108648368 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) + 472 (Completion.cpp:102)
19  com.apple.JavaScriptCore            0x00000001086484b0 JSC::profiledEvaluate(JSC::ExecState*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) + 80 (Completion.cpp:117)


Discovered while writing a test case for https://bugs.webkit.org/show_bug.cgi?id=175914.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20170824/4e852d5d/attachment-0001.html>