Bug 220955

Summary: Crash from CompositeEditCommand::moveParagraphs() using Position instead of VisiblePosition
Product: WebKit Reporter: Julian Gonzalez <julian_a_gonzalez>
Component: HTML EditingAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: ews-watchlist, mifenton, rniwa, wenson_hsieh
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch
none
Patch none

Description Julian Gonzalez 2021-01-25 15:22:18 PST 
frame #0: WebCore`WebCore::makeBoundaryPoint(WebCore::VisiblePosition const&)+81
frame #1: WebCore`decltype(makeSimpleRangeHelper(makeBoundaryPointHelper(std::forward<WebCore::VisiblePosition const&>(fp)), makeBoundaryPointHelper(std::forward<WebCore::VisiblePosition&>(fp)))) WebCore::makeSimpleRange<WebCore::VisiblePosition const&, WebCore::VisiblePosition&>(WebCore::VisiblePosition const&, WebCore::VisiblePosition&)+26
frame #2: WebCore`WebCore::CompositeEditCommand::moveParagraphs(WebCore::VisiblePosition const&, WebCore::VisiblePosition const&, WebCore::VisiblePosition const&, bool, bool)+403
frame #3: WebCore`WebCore::InsertListCommand::doApplyForSingleParagraph(bool, WebCore::HTMLQualifiedName const&, WebCore::SimpleRange&)+7504
frame #4: WebCore`WebCore::InsertListCommand::doApply()+7534
frame #5: WebCore`WebCore::CompositeEditCommand::applyCommandToComposite(WTF::Ref<WebCore::EditCommand, WTF::DumbPtrTraits<WebCore::EditCommand> >&&)+79
frame #6: WebCore`WebCore::IndentOutdentCommand::outdentParagraph()+690
frame #7: WebCore`WebCore::IndentOutdentCommand::formatSelection(WebCore::VisiblePosition const&, WebCore::VisiblePosition const&)+220
frame #8: WebCore`WebCore::ApplyBlockElementCommand::doApply()+1256
frame #9: WebCore`WebCore::CompositeEditCommand::apply()+500
frame #10: WebCore`WebCore::executeOutdent(WebCore::Frame&, WebCore::Event*, WebCore::EditorCommandSource, WTF::String const&)+229
frame #11: WebCore`WebCore::Document::execCommand(WTF::String const&, bool, WTF::String const&)+77

The call to makeSimpleRange(start, end) requires non-null VisiblePositions - not non-null Positions.
Similar to bug 220630

<rdar://problem/70880426>
Comment 1 Julian Gonzalez 2021-01-25 15:30:02 PST 
Created attachment 418346 [details]
Patch
Comment 2 Julian Gonzalez 2021-01-25 17:48:51 PST 
Test failures here look legitimate (though I can't reproduce them locally). I'll keep working on this.
Comment 3 Ryosuke Niwa 2021-01-25 17:58:25 PST 
Comment on attachment 418346 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=418346&action=review

> LayoutTests/editing/inserting/paragraph-outdent-animationframe-crash.html:20
> +    document.execCommand("selectAll", false);
> +    window.requestAnimationFrame(dooutdent);

I think the test failure comes from this code running after this test had finished running.
You need to add testRunner.waitUntilDone where you call dumpAsText,
and call testRunner.notifyDone when the test is done running perhaps at the end of dooutdent?
Be sure to verify that the crash still reproduces without the fix if you made those changes to the test.
Comment 4 Julian Gonzalez 2021-01-27 17:13:28 PST 
(In reply to Ryosuke Niwa from comment #3)
> Comment on attachment 418346 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=418346&action=review
> 
> > LayoutTests/editing/inserting/paragraph-outdent-animationframe-crash.html:20
> > +    document.execCommand("selectAll", false);
> > +    window.requestAnimationFrame(dooutdent);
> 
> I think the test failure comes from this code running after this test had
> finished running.
> You need to add testRunner.waitUntilDone where you call dumpAsText,
> and call testRunner.notifyDone when the test is done running perhaps at the
> end of dooutdent?
> Be sure to verify that the crash still reproduces without the fix if you
> made those changes to the test.

This ended up being a little more complicated, but Ryosuke figured it out. Thanks to him for cleaning the test up!
Comment 5 Julian Gonzalez 2021-01-27 17:19:02 PST 
Created attachment 418602 [details]
Patch
Comment 6 Ryosuke Niwa 2021-01-28 02:55:21 PST 
Comment on attachment 418602 [details]
Patch

Looks good.
Comment 7 EWS 2021-01-28 02:58:29 PST 
Committed r272008: <https://trac.webkit.org/changeset/272008>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 418602 [details].