Bug 200144 – Moving right by word boundary right before an object element followed by a br element hangs

• Component: HTML Editing
• Status: RESOLVED FIXED

[Ryosuke Niwa]

Created attachment 374922 [details]
Demo

Moving to the right by word boundary immediately before a word boundary causes a hang.

<rdar://problem/53285794>

[Ryosuke Niwa]

Created attachment 374928 [details]
Fixes the hang

[Ryosuke Niwa]

Is 
שלום
עולם
the right way to say "hello world" in Hebrew?

[Ryosuke Niwa]

Some analysis:

7/24/19, 8:10 PM Ryosuke Niwa:
We’re stuck in wordBreakIteratorForMinOffsetBoundary with previousBox pointing to the inline box of the object, and previousBox->renderer() being at the br element after the object element.

7/24/19, 8:19 PM Ryosuke Niwa:
So the problem here is that previousTextOrLineBreakBox never returns a box for the line consisting only of the object element.

7/24/19, 8:22 PM Ryosuke Niwa:
Ugh… scratch that. We’re returning the line box for the object element.

7/24/19, 8:35 PM Ryosuke Niwa:
Okay, in logicallyPreviousBox(~, br’s inline box, previousBoxInDifferentLine=true, ~), previousTextOrLineBreakBox doesn’t return the inline box for the object element, and previousTextOrLineBreakBox finds nothing since there is no more inline box left above the object element in this block flow.

7/25/19, 3:07 PM Ryosuke Niwa:
Hm… so there is something confusing happening here. We’re trying to find the previous position at the beginning of “world” which appears object & br elements. The previous box is that of br element but VisiblePosition points to the beginning of “world”. As a result, when we get to previousRootInlineBoxCandidatePosition, we think previousNode, which is object element and br element are in different lines (which is correct). So, we’d return the position after the object element from previousRootInlineBoxCandidatePosition. Then previousRoot is pointing at the root inline box of the line which contains the object & br elements. Now, previousTextOrLineBreakBox is called with this root box with box=0, resulting in the inlinebox for BR to be returned. We’re back to where we were.

[Ryosuke Niwa]

Created attachment 374929 [details]
Added a change log

[Ryosuke Niwa]

Comment on attachment 374929 [details]
Added a change log

Clearing flags on attachment: 374929

Committed r247881: <https://trac.webkit.org/changeset/247881>

[Ryosuke Niwa]

All reviewed patches have been landed.  Closing bug.