Bug 196342

Summary: Debug assert in DOMSelection::containsNode when node belongs to a different tree
Product: WebKit Reporter: Ryosuke Niwa <rniwa>
Component: DOMAssignee: Ryosuke Niwa <rniwa>
Status: RESOLVED FIXED    
Severity: Normal CC: cdumez, koivisto, thorton, webkit-bug-importer, wenson_hsieh, zalan
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Fixes the bug koivisto: review+

Ryosuke Niwa
Reported 2019-03-27 23:47:47 PDT
DOMSelection::containsNode has a bogus debug assertion that Range::compareBoundaryPoints(parentNode, nodeIndex, &selectedRange->startContainer(), selectedRange->startOffset()) would never return an exception. That is not true when startRange and parentNode belong to two different trees.
Attachments
Fixes the bug (4.32 KB, patch)
2019-03-28 00:12 PDT, Ryosuke Niwa 		koivisto: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Ryosuke Niwa
Comment 1 2019-03-28 00:12:02 PDT
Created attachment 366156 [details] Fixes the bug
Ryosuke Niwa
Comment 2 2019-03-28 14:23:51 PDT
Committed r243621: <https://trac.webkit.org/changeset/243621>
Radar WebKit Bug Importer
Comment 3 2019-03-28 14:24:22 PDT
<rdar://problem/49395651>
Ryosuke Niwa
Comment 4 2019-03-28 14:25:14 PDT
<rdar://problem/48566596>
Note You need to log in before you can comment on or make changes to this bug.