[webkit-reviews] review requested: [Bug 121791] ASSERTION FAILED: comparePositions(newEnd, newStart) >= 0 in WebCore::ApplyStyleCommand::updateStartEnd : [Attachment 213064] Proposed patch

[bugzilla-daemon at webkit.org]

Renata Hodovan <reni at webkit.org> has asked  for review:
Bug 121791: ASSERTION FAILED: comparePositions(newEnd, newStart) >= 0 in
WebCore::ApplyStyleCommand::updateStartEnd
https://bugs.webkit.org/show_bug.cgi?id=121791

Attachment 213064: Proposed patch
https://bugs.webkit.org/attachment.cgi?id=213064&action=review

------- Additional Comments from Renata Hodovan <reni at webkit.org>
I do not have a well enough understanding of what is going on here to be sure
the fix is correct, but it seems that TextIterator::handleReplacedElement()
emitts an ',' character in TextIterator::handleReplacedElement() (because of
the button element) and due to this the endRange of selection will be
determined as endContainer + endOffset instead of startContainer + startOffset,
what causes that the of startPosition of endRange will be bigger at the
assertion than the startPostion of startRange.