Load the attached test case and double click after the end of the word 'reproducible'. The word 'reproducible' should be selected. Insead, a selection is created that reaches outside the editable div.
Created attachment 4839 [details] testcase
This bug comes from the fact that SelectionController::validate does changes to the selection that aren't validated (changes when the granularity passed to validate does not equal CHARACTER). It doesn't seem right that such changes are part of "validation" at all.
Created attachment 4853 [details] Similar reduced case, but double-click on last word over-selects This attachment is similar, but I found that if you double-click on the last word -- not just the space past the last word -- you get over-selection as well. This is probably the same root problem....
Created attachment 4915 [details] patch validate() used to do expansion of the selection. The expansion itself wasn't validated, so it was allowed to expand and extend outside an editable area. Also m_base and m_extent weren't updated with the results of the expansion. The patch moves expansion of the selection from validate() to expandUsingGranularity(). Removes the granularity parameter to validate() since it's no longer used.
testing details: added a few new layout tests, all current tests pass.
Comment on attachment 4915 [details] patch Wow, looks really good! r=me
Landed the patch.