&node == innerEditor->lastChild() |
|||||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=6261245795893248 Fuzzer: mbarbella_js_mutation_layout Job Type: linux_debug_chrome Platform Id: linux Crash Type: ASSERT Crash Address: Crash State: &node == innerEditor->lastChild() blink::HTMLTextAreaElement::subtreeHasChanged blink::HTMLTextFormControlElement::defaultEventHandler Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_chrome&range=173978:174317 Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv97HIC6XGdLFyCwRVLG1QcR9QVXUKXzuPu48onbMW7lH-NT73IXwXgIy7iMrbve109PX37oRmPNMvZ9d3xasW4z304m2zrj70oTEv5svzRp6tOY6Sdeuj1NmA_LFhKnNWRXzN41VEBk4UT76AlB1fhNSaSDoSxavUhsTJcCeChN4kir3xeo?testcase_id=6261245795893248 Additional requirements: Requires Gestures Filer: tkonchada See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Jun 27 2016
,
Jun 28 2016
TEXTAREA 0x3f5a29c24358 (focused) #shadow-root 0x3f5a29c24438 DIV 0x3f5a29c24508 ID="inner-editor" (editable) #text 0x3f5a29c263e8 "\n" * BR 0x3f5a29c26438 (editable) #text 0x3f5a29c245c0 "" There is an empty Text node after <br>. It's harmless.
,
Jun 28 2016
Minimized test case:
<!DOCTYPE html>
<body>
<script>
onload = function() {
document.querySelector('textarea').focus();
document.execCommand('selectAll');
selection = document.getSelection();
selection.deleteFromDocument();
document.execCommand('insertText', false, '\n');
}
</script>
<textarea>
text3
</textarea>
</body>
,
Jul 1 2016
ClusterFuzz has detected this issue as fixed in range 403408:403412. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6261245795893248 Fuzzer: mbarbella_js_mutation_layout Job Type: linux_debug_chrome Platform Id: linux Crash Type: ASSERT Crash Address: Crash State: &node == innerEditor->lastChild() blink::HTMLTextAreaElement::subtreeHasChanged blink::HTMLTextFormControlElement::defaultEventHandler Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_chrome&range=173978:174317 Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_chrome&range=403408:403412 Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv97HIC6XGdLFyCwRVLG1QcR9QVXUKXzuPu48onbMW7lH-NT73IXwXgIy7iMrbve109PX37oRmPNMvZ9d3xasW4z304m2zrj70oTEv5svzRp6tOY6Sdeuj1NmA_LFhKnNWRXzN41VEBk4UT76AlB1fhNSaSDoSxavUhsTJcCeChN4kir3xeo?testcase_id=6261245795893248 Additional requirements: Requires Gestures See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jul 1 2016
ClusterFuzz testcase is verified as fixed, closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Jul 5 2016
This is still reproducible with #4.
,
Jul 5 2016
,
Jul 6 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/3f6836d02c1cc98aec47ae8c1ff1e64522290403 commit 3f6836d02c1cc98aec47ae8c1ff1e64522290403 Author: tkent <tkent@chromium.org> Date: Wed Jul 06 05:21:40 2016 Fix an assertion failure in HTMLTextAreaElement::subtreeHasChanged. Selection.deleteFromDocument() leaves an empty Text node in innerEditor of TEXTAREA element, and InsertLineBreakCommand inserted a placeholder BR element *before* the empty Text node. It broke the assumption of TEXTAREA element. This CL makes sure the BR element is appended at the last. BUG= 623547 Review-Url: https://codereview.chromium.org/2125553002 Cr-Commit-Position: refs/heads/master@{#403853} [add] https://crrev.com/3f6836d02c1cc98aec47ae8c1ff1e64522290403/third_party/WebKit/LayoutTests/editing/inserting/insert-paragraph-empty-textarea.html [modify] https://crrev.com/3f6836d02c1cc98aec47ae8c1ff1e64522290403/third_party/WebKit/Source/core/editing/commands/InsertLineBreakCommand.cpp
,
Jul 6 2016
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||
►
Sign in to add a comment |
|||||||
Comment 1 by tkonch...@chromium.org
, Jun 27 2016Labels: Te-Logged M-52
Owner: tkent@chromium.org
Status: Assigned (was: Available)