204401 2019-11-20 00:49:57 -0800 [GTK] Web Process crashes when making a text selection 2019-11-20 00:56:59 -0800 1 1 1 Unclassified WebKit WebKitGTK WebKit Nightly Build Unspecified Unspecified RESOLVED DUPLICATE 199224 P2 Normal --- 1 svillar webkit-unassigned bugs-noreply oldest_to_newest 1591920 0 svillar 2019-11-20 00:49:57 -0800 I get a consistent crash selecting text using epy with 2.26.2. It's fairly easy to reproduce: 1- Load https://bugs.chromium.org/p/chromium/issues/detail?id=741235 (should happen in other websites but with this is super easy) 2- Click and drag quickly to select the first comment going a little bit beyond it The web process will crash. 1591921 1 svillar 2019-11-20 00:53:59 -0800 I don't have a Debug build ATM but could get this backtrace from Release. Looks like a generic WebCore issue in the code that traverses nodes to create and serialize the selection. Thread 1 "WebKitWebProces" received signal SIGSEGV, Segmentation fault. 0x00007f831f7bb6fa in WebCore::StyledMarkupAccumulator::traverseNodesForSerialization(WebCore::Node*, WebCore::Node*, WebCore::StyledMarkupAccumulator::NodeTraversalMode) () from ~/checkout/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37 (gdb) bt #0 0x00007f831f7bb6fa in WebCore::StyledMarkupAccumulator::traverseNodesForSerialization(WebCore::Node*, WebCore::Node*, WebCore::StyledMarkupAccumulator::NodeTraversalMode) () from ~/checkout/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37 #1 0x00007f831f7bc1cd in WebCore::StyledMarkupAccumulator::serializeNodes(WebCore::Position const&, WebCore::Position const&) () from ~/checkout/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37 #2 0x00007f831f7bc780 in WebCore::serializePreservingVisualAppearanceInternal(WebCore::Position const&, WebCore::Position const&, WTF::Vector<WebCore::Node*, 0ul, WTF::CrashOnOverflow, 16ul>*, WebCore::ResolveURLs, WebCore::SerializeComposedTree, WebCore::AnnotateForInterchange, WebCore::ConvertBlocksToInlines, WebCore::StandardFontFamilySerializationMode, WebCore::MSOListMode) () from ~/checkout/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37 #3 0x00007f831f7be99a in WebCore::serializePreservingVisualAppearance(WebCore::VisibleSelection const&, WebCore::ResolveURLs, WebCore::SerializeComposedTree, WTF::Vector<WebCore::Node*, 0ul, WTF::CrashOnOverflow, 16ul>*) () from ~/checkout/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37 #4 0x00007f831eb7d727 in WebKit::WebEditorClient::updateGlobalSelection(WebCore::Frame*) () from ~/checkout/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37 #5 0x00007f831f72b26f in WebCore::Editor::respondToChangedSelection(WebCore::VisibleSelection const&, WTF::OptionSet<WebCore::FrameSelection::SetSelectionOption>) () from ~/checkout/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37 #6 0x00007f831f73be6f in WebCore::FrameSelection::setSelectionWithoutUpdatingAppearance(WebCore::VisibleSelection const&, WTF::OptionSet<WebCore::FrameSelection::SetSelectionOption>, WebCore::FrameSelection::CursorAlignOnScroll, WebCore::TextGranularity) () from ~/checkout/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37 #7 0x00007f831f7372e4 in WebCore::FrameSelection::setSelection(WebCore::VisibleSelection const&, WTF::OptionSet<WebCore::FrameSelection::SetSelectionOption>, WebCore::AXTextStateChangeIntent, WebCore::FrameSelection::CursorAlignOnScroll, WebCore::TextGranularity) () from ~/checkout/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37 #8 0x00007f831f73966c in WebCore::FrameSelection::setSelectionByMouseIfDifferent(WebCore::VisibleSelection const&, WebCore::TextGranularity, WebCore::FrameSelection::EndPointsAdjustmentMode) () from ~/checkout/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37 #9 0x00007f831fb5ee67 in WebCore::EventHandler::updateSelectionForMouseDrag(WebCore::HitTestResult const&) () from ~/checkout/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37 #10 0x00007f831fb7c6a9 in WebCore::EventHandler::handleMouseDraggedEvent(WebCore::MouseEventWithHitTestResults const&, WebCore::CheckDragHysteresis) () from ~/checkout/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37 #11 0x00007f831fb842df in WebCore::EventHandler::handleMouseMoveEvent(WebCore::PlatformMouseEvent const&, WebCore::HitTestResult*, bool) [clone .part.0] () from ~/checkout/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37 #12 0x00007f831fb8449d in WebCore::EventHandler::mouseMoved(WebCore::PlatformMouseEvent const&) () from ~/checkout/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37 #13 0x00007f831eb8a7f2 in WebKit::WebPage::mouseEvent(WebKit::WebMouseEvent const&) () from ~/checkout/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37 1591922 2 svillar 2019-11-20 00:56:59 -0800 *** This bug has been marked as a duplicate of bug 199224 ***