[Webkit-unassigned] [Bug 89159] [Shadow][Crash] Pressing delete key on table in Shadow DOM triggers an assert.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=89159





--- Comment #4 from Hayato Ito <hayato at chromium.org>  2012-06-26 16:47:07 PST ---
It seems that the root cause is ComparePositions() in the repro case.

Let me explain using the following simplified example.

<div id=top contenteditable>  // There is no contenteditable ancestor
   <div>hello</div>
   <div>world</div>
</div>

After mouse dragging from [wo|rld] to outside of top, suppose VisibleSelection::validate() is called with the status:

  start: {anchorNode: text node of [world], anchorType: OffsetInAnchor}
  end:  {anchorNode: #top, anchorType: AfterAnchor}

After validate(), a visibleSelection should be:

  start: {anchorNode: text node of [world], anchorType: OffsetInAnchor}
  end:  {anchorNode: #top, anchorType: AfterChildren}

But the actual result is:

  start: {anchorNode: text node of [world], anchorType: OffsetInAnchor}
  end:  {anchorNode: #top, anchorType: AfterAnchor}

Yeah, nothing changes. That should be changed after adjustSelectionToAvoidCrossingEditingBoundaries() is called in validate().
The following code in adjustSelectionToAvoidCrossingEditingBoundaries():

  VisiblePosition last = lastEditablePositionBeforePositionInRoot(m_end, baseRoot);   

returns Position: {anchorNode: #top, anchorType: AfterAnchor} as last.

In lastEditablePositionBeforePositionInRoot(m_end, baseRoot), comparePositions is called as follows:

  if (comparePositions(position, lastPositionInNode(highestRoot)) == 1) 

  with position: anchorNode: {anchorNode: #top, anchorType: AfterAnchor}
         lastPositionInNode(highestRoot): {anchorNode: #top, anchorType: AfterChildren}

Ideally, comparePositions() should return 1 in this case. But that seemed to return non-1 value. If it returns 1, lastPositionInNode(highestRoot) is used as end() and things will work well.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.