Bug 258254 – document.execCommand('insertOrderedList'); can hang browser on removing list

• Component: HTML Editing
• Status: NEW

[Ahmad Saleem]

Hi Team,

This seems to another test case, which hangs tab (only tab) and make it non-interactive, if we follow the instructions as per test case.

It is from crbug.com/653732

^ I came across this bug while looking into: crbug.com/571420, which has following commit:

Blink Commit: https://chromium.googlesource.com/chromium/src.git/+/f15d4cc339737df653274e39726ae0d14d409b18

^ Test Case from above in JSFiddle: https://jsfiddle.net/5y09um8b/

^^ Safari Technology Preview 172 and Firefox Nightly 116 both fail above.

I think we should fix hanging issue and ensure that Safari remain interactive, so raising it for tracking and fixing purposes.

Thanks!

[Ahmad Saleem]

Hanging test case is in URL field. Forgot to add.

[Radar WebKit Bug Importer]

<rdar://problem/111272008>

[Ahmad Saleem]

Change in 'Source/WebCore/editing/Editing.cpp' and following function 'firstEditablePositionAfterPositionInRoot':

From Line 271 onward:

Node* nonEditableNode = nullptr;
    while (candidate.deprecatedNode() && !isEditablePosition(candidate) && candidate.deprecatedNode()->isDescendantOf(*highestRoot)) {
        nonEditableNode = candidate.deprecatedNode();
        candidate = isAtomicNode(candidate.deprecatedNode()) ? positionInParentAfterNode(candidate.deprecatedNode()) : nextVisuallyDistinctCandidate(candidate);
    }
    if (candidate.deprecatedNode() && candidate.deprecatedNode() != highestRoot && !candidate.deprecatedNode()->isDescendantOf(*highestRoot))
        return { };
    if (nonEditableNode && nonEditableNode->isDescendantOf(candidate.deprecatedNode()))
        candidate = nextVisuallyDistinctCandidate(candidate);
    return candidate;
}

[Ahmad Saleem]

(In reply to Ahmad Saleem from comment #3)
> Change in 'Source/WebCore/editing/Editing.cpp' and following function
> 'firstEditablePositionAfterPositionInRoot':
> 
> From Line 271 onward:
> 
> Node* nonEditableNode = nullptr;
>     while (candidate.deprecatedNode() && !isEditablePosition(candidate) &&
> candidate.deprecatedNode()->isDescendantOf(*highestRoot)) {
>         nonEditableNode = candidate.deprecatedNode();
>         candidate = isAtomicNode(candidate.deprecatedNode()) ?
> positionInParentAfterNode(candidate.deprecatedNode()) :
> nextVisuallyDistinctCandidate(candidate);
>     }
>     if (candidate.deprecatedNode() && candidate.deprecatedNode() !=
> highestRoot && !candidate.deprecatedNode()->isDescendantOf(*highestRoot))
>         return { };
>     if (nonEditableNode &&
> nonEditableNode->isDescendantOf(candidate.deprecatedNode()))
>         candidate = nextVisuallyDistinctCandidate(candidate);
>     return candidate;
> }

This fixes hanging test case but the problem is that the test case uses 'assert_selection.js' and does not produce 'passing' test output. :-(

Something is wrong with 'assert_selection.js' while using in WebKit.

[Ahmad Saleem]

Draft PR - https://github.com/WebKit/WebKit/pull/29422

It is leading to legit WPT failure - which we are passing earlier. :-(

[Ahmad Saleem]

Failing - imported/w3c/web-platform-tests/editing/run/forwarddelete.html?6001-last

> PASS [["forwarddelete",""]] "foo<span>bar[]<span contenteditable=false>baz</span></span>qux" compare innerHTML
> FAIL [["forwarddelete",""]] "foo<span>bar[]<span contenteditable=false>baz</span></span>qux" compare innerHTML assert_equals: Unexpected innerHTML (after normalizing inline style) expected "foo<span>bar</span>qux" but got "foo<span>bar</span>ux"

[Ahmad Saleem]

PR attempt - https://github.com/WebKit/WebKit/pull/29422

It leads to legit failure in following WPT:

imported/w3c/web-platform-tests/editing/run/forwarddelete.html?6001-7000

and following fails:

> [["forwarddelete",""]] "foo<span>bar[]<span contenteditable=false>baz</span></span>qux" compare innerHTML

> FAIL [["forwarddelete",""]] "foo<span>bar[]<span contenteditable=false>baz</span></span>qux" compare innerHTML assert_equals: Unexpected innerHTML (after normalizing inline style) expected "foo<span>bar</span>qux" but got "foo<span>bar</span>ux"