plainText() returns a partial result when the node contains RTL text

• Component: DOM
• Status: VERIFIED FIXED

Summary: Copying a selection to the clipboard or calling innerText on a node results in only part of the 
expected text being copied or returned in certain cases if the node contains RTL text.

To reproduce: open the attached testcase in Safari. Select the words "select and copy this sentence", 
choose Edit > Copy and then examine the clipboard contents.

Result: only "select " is copied to the clipboard.

The testcase also contains an example of how innerText returns only the text up to "select ".

Analysis: plainText() fails due to a bug in TextIterator::handleTextBox(), where the comment says 
"Determine what the next text box will be, but don't advance yet", in the RTL case it does advance. 
Combined with the sequence of newline and space, this causes the iterator to reach the end 
prematurely.

Created attachment 5015 [details]
testcase

Created attachment 5016 [details]
Advance m_sortedTextBoxes only when necessary

[Darin Adler]

Comment on attachment 5016 [details]
Advance m_sortedTextBoxes only when necessary

r=me