| Summary: | ASSERTION FAILED: selection.isRange() in InsertListCommand::doApply | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Jack <shihchieh_lee> | ||||||
| Component: | HTML Editing | Assignee: | Nobody <webkit-unassigned> | ||||||
| Status: | RESOLVED FIXED | ||||||||
| Severity: | Normal | CC: | bfulgham, ews-feeder, product-security, rniwa, shihchieh_lee, webkit-bug-importer, wenson_hsieh | ||||||
| Priority: | P2 | Keywords: | InRadar | ||||||
| Version: | WebKit Nightly Build | ||||||||
| Hardware: | All | ||||||||
| OS: | All | ||||||||
| Attachments: |
|
||||||||
|
Description
Jack
2020-04-07 18:59:47 PDT
Created attachment 395771 [details]
Patch
Root cause for the assertion crash: 1. The code is executing command “insertUnorderedList”. 2. Because the original selected range for insertion is inside the table, in function selectionForParagraphIteration we try to move the position to the end of the table. 3. The end happens to be a text node, so the returned selection becomes “CaretSelection” and fails the assertion. BODY 0x60c00006c280 (renderer 0x6120000634c0) LABEL 0x60c00006c340 (renderer 0x6110000c3cc0) #text 0x60800004fea0 "\n" UL 0x60c00006c400 (renderer 0x612000063640) #text 0x60800004ff20 "\n" SELECT 0x613000063a80 (renderer 0x615000083980) #text 0x6080000540a0 "\n" IFRAME 0x613000063c40 (renderer 0x612000063dc0) * TABLE 0x60e0000597c0 (renderer 0x61400003ae40) #text 0x60800004ffa0 "\n" TBODY 0x60c00006c4c0 (renderer 0x61300006c680) TR 0x60c00006c580 (renderer 0x6110000c4080) TH 0x60c00006c640 (renderer 0x6120000640c0) #text 0x608000054120 "a" #text 0x6080000541a0 "\n\n" STYLE 0x61000002dd40 (renderer 0x0) #text 0x608000056ca0 "\n" after, offset:0 Test case:
<script>
window.onload = () => {
window.getSelection().setBaseAndExtent(TH,1,STYLE,1);
document.execCommand("insertUnorderedList", false);
}
</script>
<body contenteditable="true"><table><th id=TH>a</th><style id=STYLE></style>
Comment on attachment 395771 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=395771&action=review > LayoutTests/editing/inserting/insert-list-in-table-assert.html:13 > + if (window.testRunner) { Nit - no braces around the single line if statement. > LayoutTests/editing/inserting/insert-list-in-table-assert.html:15 > + } Ditto. > LayoutTests/editing/inserting/insert-list-in-table-assert.html:19 > +<body contenteditable="true"><table><th id=TH>a</th><style id=STYLE></style> Nit - let’s add some closing tags to clean up the markup a bit. I’m also curious why (or if) the style element is needed in the repro case. Created attachment 396115 [details]
Patch for landing
Thanks Wenson. As you mentioned, I tried replacing <style> with <p> or <span>, the issue doesn't reproduce. However, with <script> it crashes. And sorry somehow land-safely didn't work, so could you please review again? (In reply to Wenson Hsieh from comment #5) > Comment on attachment 395771 [details] > Patch > > I’m also curious why (or if) the style element is needed in the repro case. Wait, it seems to work. It is in the commit queue now. (In reply to Jack from comment #7) > And sorry somehow land-safely didn't work, so could you please review again? Committed r259899: <https://trac.webkit.org/changeset/259899> All reviewed patches have been landed. Closing bug and clearing flags on attachment 396115 [details]. |