[Webkit-unassigned] [Bug 38175] New: Incorrect arithmetic in InputElement::handleBeforeTextInsertedEvent

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=38175

           Summary: Incorrect arithmetic in
                    InputElement::handleBeforeTextInsertedEvent
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: PC
               URL: http://crbug.com/new
        OS/Version: Mac OS X 10.5
            Status: UNCONFIRMED
          Severity: Normal
          Priority: P2
         Component: HTML Editing
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: dcheng at chromium.org
                CC: rolandsteiner at chromium.org


In http://crbug.com/new, attempt to drag some text from a TEXTAREA to an empty
text input. It will fail, and will raise an assert in debug builds:
ASSERT(oldLength >= selectionLength);

I think this is because WebCore is calculating oldLength from the wrong
element; it looks like it's calculating the length of the text field being
dragged to rather than the text field being dragged from. However, I'm not
familiar enough with this code to say for sure.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.