Bug 196342

Summary:

Debug assert in DOMSelection::containsNode when node belongs to a different tree

Product:

WebKit

Reporter:

Ryosuke Niwa <rniwa>

Component:

DOM

Assignee:

Ryosuke Niwa <rniwa>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

cdumez, koivisto, thorton, webkit-bug-importer, wenson_hsieh, zalan

Priority:

Keywords:

InRadar

Version:

WebKit Nightly Build

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
Fixes the bug	koivisto: review+

Description Ryosuke Niwa 2019-03-27 23:47:47 PDT

DOMSelection::containsNode has a bogus debug assertion that Range::compareBoundaryPoints(parentNode, nodeIndex, &selectedRange->startContainer(), selectedRange->startOffset()) would never return an exception. That is not true when startRange and parentNode belong to two different trees.

Comment 1 Ryosuke Niwa 2019-03-28 00:12:02 PDT

Created attachment 366156 [details]
Fixes the bug

Comment 2 Ryosuke Niwa 2019-03-28 14:23:51 PDT

Committed r243621: <https://trac.webkit.org/changeset/243621>

Comment 3 Radar WebKit Bug Importer 2019-03-28 14:24:22 PDT

<rdar://problem/49395651>

Comment 4 Ryosuke Niwa 2019-03-28 14:25:14 PDT

<rdar://problem/48566596>