Bug 207875

Summary: Crash when Node::normalize() triggers mutation event that modifies child order
Product: WebKit Reporter: Sunny He <sunny_he>
Component: Layout and RenderingAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: ajuma, bfulgham, cdumez, commit-queue, dbates, esprehn+autocc, ews-watchlist, kangil.han, rniwa, simon.fraser, webkit-bug-importer, zalan
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch
none
Patch
none
Patch
none
Patch none

Sunny He
Reported 2020-02-17 18:30:33 PST
rdar://58976682
Attachments
Patch (4.25 KB, patch)
2020-02-17 18:32 PST, Sunny He 		no flags
DetailsFormatted DiffDiff
Patch (4.52 KB, patch)
2020-02-18 15:15 PST, Sunny He 		no flags
DetailsFormatted DiffDiff
Patch (4.69 KB, patch)
2020-02-19 14:35 PST, Sunny He 		no flags
DetailsFormatted DiffDiff
Patch (4.69 KB, patch)
2020-02-19 16:45 PST, Sunny He 		no flags
DetailsFormatted DiffDiff
Show Obsolete (3) View All Add attachment proposed patch, testcase, etc.
Sunny He
Comment 1 2020-02-17 18:32:42 PST
Created attachment 391017 [details] Patch
Sunny He
Comment 2 2020-02-18 15:15:22 PST
Created attachment 391101 [details] Patch
Sunny He
Comment 3 2020-02-18 15:24:49 PST
After playing around with normalize() and DOMSubtreeModified event, I'm not so sure about that FIXME. If I log in the eventhandler, I see Chrome also calls the event handler multiple times if multiple text nodes were merged. Am I reading the DOM spec correctly (https://dom.spec.whatwg.org/#dom-node-normalize)?
Ryosuke Niwa
Comment 4 2020-02-18 18:15:33 PST
Comment on attachment 391101 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=391101&action=review > Source/WebCore/dom/Node.cpp:674 > + // Update start/end for any affected Ranges I don’t think this comment is necessary since the code says that. If anything, we should explain why we need call this before appendData instead. > LayoutTests/ChangeLog:17 > + * fast/dom/Node/normalize_mutation_event.html: Added. Please use - instead of _ in file names
Sunny He
Comment 5 2020-02-19 14:35:14 PST
Created attachment 391201 [details] Patch
Ryosuke Niwa
Comment 6 2020-02-19 16:19:03 PST
Comment on attachment 391201 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=391201&action=review > Source/WebCore/ChangeLog:5 > + rdar://58976682 Please wrap radar URL in < & >. > Source/WebCore/dom/Node.cpp:680 > + Nit: whitespace.
Sunny He
Comment 7 2020-02-19 16:45:43 PST
Created attachment 391221 [details] Patch
WebKit Commit Bot
Comment 8 2020-02-19 19:36:58 PST
Comment on attachment 391221 [details] Patch Clearing flags on attachment: 391221 Committed r257036: <https://trac.webkit.org/changeset/257036>
WebKit Commit Bot
Comment 9 2020-02-19 19:37:01 PST
All reviewed patches have been landed. Closing bug.
Ryosuke Niwa
Comment 10 2020-03-04 19:44:31 PST
*** Bug 208314 has been marked as a duplicate of this bug. ***
Note You need to log in before you can comment on or make changes to this bug.