Re: Crashing from undo/redo using "replaceSelectionWithText"

Hi all,

I’m having a problem with the undo/redo that is implemented in WebKit. When I do something that alters the selected text (like [WebView replaceSelectionWithText] or changing the font of the selected text) inside of the delegate method of NSComboBox, comboBoxSelectionDidChange, the undo/redo behaves incorrectly. For example:

1. Type “123”
2. Select “2” and trigger the NSComboBox delegate notification, which is supposed to replace the selection with “foo”. The result is “1fooc”
3. Undo. This gives “foo123”, should give “123”
4. Redo. This gives “foo1foo3”, should give “1foo3”
5. Undo twice. This gives “foo”, should give the empty string (original starting point).
   

It looks like the undo just accidentally adds an extra “foo” at the beginning. Occasionally, doing undo/redos will actually make the program crash with an EXEC_BAD_ACCESS with this stack trace:

#0    0x95632692 in WebCore::InsertLineBreakCommand::doApply
#1    0x955c05fd in WebCore::EditCommand::apply
#2    0x955c0cfc in WebCore::CompositeEditCommand::applyCommandToComposite
#3    0x95697c3c in WebCore::InsertParagraphSeparatorCommand::doApply
#4    0x955c05fd in WebCore::EditCommand::apply
#5    0x955c0cfc in WebCore::CompositeEditCommand::applyCommandToComposite
#6    0x95777767 in WebCore::CompositeEditCommand::insertParagraphSeparator
#7    0x9562690f in WebCore::ReplaceSelectionCommand::doApply
#8    0x955c05fd in WebCore::EditCommand::apply
#9    0x956b2cfb in -[WebCoreFrameBridge replaceSelectionWithFragment:selectReplacement:smartReplace:matchStyle:]
#10    0x9574efb5 in -[WebCoreFrameBridge replaceSelectionWithText:selectReplacement:smartReplace:]
#11    0x91f0889b in -[WebView(WebViewUndoableEditing) replaceSelectionWithText:]

This seems to happen if there is more content in the webview (rather than starting from a fresh copy), leading me to think that the operation is putting the DOM tree in a state that is inconsistent with the undo/redo stack.

The strange thing is that this happens if I’m calling from “comboBoxSelectionDidChange”, but not if I call it from “comboBoxSelectionIsChanging” (another NSComboBox delegate method).

Any ideas, or should I file a bug?