Assertion failure in Range::processContentsBetweenOffsets

• Component: DOM
• Status: RESOLVED FIXED

[Ryosuke Niwa]

Merge https://chromium.googlesource.com/chromium/blink/+/c15de182774c7859c20d97126eb844ae97b792a4

https://code.google.com/p/chromium/issues/detail?id=240594

Make Range::processContentsBetweenOffsets() to handle node modification by mutation event handler

This patch changes ASSERT statements for checking |endOffset| inbound in Range::processContentsBetweenOffsets() to limit |endOffset|. This situation can be happened when DOMNodeRemovedFromDocument event handler splits text nodes, Range::insertNode() on text node, in the range calling Range::deleteContents().

This is the last part of fixing issue 240594.

[Ryosuke Niwa]

Created attachment 214189 [details]
Fixes the bug

[Ryosuke Niwa]

Comment on attachment 214189 [details]
Fixes the bug

View in context: https://bugs.webkit.org/attachment.cgi?id=214189&action=review

> Source/WebCore/dom/Range.cpp:792
> +        startOffset = std::min(startOffset, endOffset);

The Blink patch didn't adjust startOffset so I'm doing that here.

> Source/WebCore/dom/Range.cpp:807
> +        startOffset = std::min(startOffset, endOffset);

Ditto.

> LayoutTests/fast/dom/Range/range-delete-contents-mutation-event-crash-expected.txt:1
> +This tests inserting a text node while calling deleteContents. WebKit should not hit an assertion.

I added this description.

> LayoutTests/fast/dom/Range/range-delete-contents-mutation-event-crash.html:11
> +var sample = document.getElementById('sample');

And got rid of obnoxious $ function.

[Ryosuke Niwa]

Created attachment 214191 [details]
Updated for ToT

[Ryosuke Niwa]

Committed r157431: <http://trac.webkit.org/changeset/157431>

[Radar WebKit Bug Importer]

<rdar://problem/15228667>