[Webkit-unassigned] [Bug 123957] New: Fix Range.insertNode when the inserted node is in the same container as the Range

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=123957

           Summary: Fix Range.insertNode when the inserted node is in the
                    same container as the Range
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Keywords: BlinkMergeCandidate
          Severity: Normal
          Priority: P2
         Component: HTML DOM
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: rniwa at webkit.org
                CC: mjs at apple.com, darin at apple.com, ap at webkit.org,
                    sam at webkit.org


Fix the bug fixed in https://chromium.googlesource.com/chromium/blink/+/fb6ca1f488703e8d4f20ce6449cc8ea210be6edb

When Range.insertNode is called on a collapsed Range, with a node
that is in the same container as the Range, the Range offsets are
incorrectly updated. This results in Debug asertions and incorect
Release behavior (and maybe more serious problems).

The fix correctly accounts for situations in which the inserted
node immediately precedes the Range in the container. The test
verifies this and other cases.


Unfortunately, neither code change nor the test meet my standard so I'll write a new fix.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.