[Webkit-unassigned] [Bug 210530] ASSERTION FAILED: !selectionToDelete.isNone() in TypingCommand::forwardDeleteKeyPressed when deleting a UserSelect::None element.

Tue Apr 14 22:38:18 PDT 2020

https://bugs.webkit.org/show_bug.cgi?id=210530

--- Comment #1 from Jack <shihchieh_lee at apple.com> ---
In processing command "forwardDelete", we first validate and modify the selection by calling FrameSelection::modify. In this case, the original selection is div, the innerText of input. However, since div is UserSelect::Node, it fails the isCandidate check, and there is no other candidate found, FrameSelection::modify returns empty selection and triggers the assertion crash.

<body><input id=input required draggable="true">
<script>
    input.focus();
    document.execCommand("forwardDelete", false);
</script>

BODY    0x60c000104f80 (renderer 0x612000067840) 
        INPUT   0x612000061fc0 (renderer 0x6120000679c0) 
                #document-fragment      0x612000062140 (renderer 0x0)  (needs style recalc) (child needs style recalc)
*                       DIV     0x60c000105040 (renderer 0x612000067b40) 
        #text   0x608000143520 "\n"
        SCRIPT  0x61000004b440 (renderer 0x0) 
                #text   0x608000143620 "\n    input.focus();\n    document.execCommand("forwardDelete", false);\n"

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200415/6a916f85/attachment.htm>