8117 2006-03-31 23:14:32 -0800 REGRESSION (NativeTextField): Drag and drop text within a text input field modifies page 2006-04-03 16:55:49 -0700 1 1 1 Unclassified WebKit HTML Editing 420+ Mac OS X 10.4 RESOLVED FIXED http://google.com/ Regression P1 Normal --- 1 mulletsailors justin.garcia oldest_to_newest 38147 0 mulletsailors 2006-03-31 23:14:32 -0800 WebKit on Mac OS X 10.4.5 using the 31 March 2006 nightly. Dragging and dropping text repeatedly within a text input field modifies the page contents. Steps to reproduce: Access http://www.google.com/ Enter javascript:alert(document.body.childNodes.length); into the location bar and note the number of child nodes. Type a query into the search field (say, "Safari WebKit") Select a portion of the text field contents (say, "Saf"), then move it elsewhere within the text field. Without deselecting the text that has been moved, move it once more to a different location. Notice that portions of the query appear at the bottom of the page contents. Verify that the page contents have changed by running javascript:alert(document.body.childNodes.length); again 38276 1 ap 2006-04-02 09:42:54 -0700 Same problem with normal contenteditable divs. ================= ASSERTION FAILED: editableRoot (/Users/ap/WebKit/WebCore/editing/ReplaceSelectionCommand.cpp:124 WebCore::ReplacementFragment::ReplacementFragment(WebCore::Document*, WebCore::DocumentFragment*, bool)) ================= 38331 2 justin.garcia 2006-04-02 22:40:22 -0700 Ah, when a ReplaceSelectionCommand is a sub-command (which is what happens during a drag), frame->selection() may be different than the endingSelection. The ReplacementFragment will need to either be given the endingSelection or a pointer back to the ReplaceSelectionCommand so it can get the endingSelection. We should get rid of the endingSelection, it's confusing. An operation should just set its selection on the frame, but through a special setter that doesn't send selection change notifications (those should only be sent for user-level selection changes). 38359 3 mjs 2006-04-02 23:25:43 -0700 These are all text field regressions so they should all be P1. 38403 4 justin.garcia 2006-04-03 10:58:29 -0700 This happens in any empty contenteditable div at the end of the document, it looks like a regression from r13628 (setting mergeStart to true for empty editable regions to fix Undo).