Bug 116509 - Fix an assertion failure in Range::textNodeSplit by Text::splitText
Summary: Fix an assertion failure in Range::textNodeSplit by Text::splitText
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: DOM (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Kent Tamura
URL:
Keywords: BlinkMergeCandidate
: 116073 (view as bug list)
Depends on:
Blocks:
 
Reported: 2013-05-20 19:45 PDT by Ryosuke Niwa
Modified: 2024-01-19 05:56 PST (History)
5 users (show)

See Also:

Attachments
Patch (4.24 KB, patch)
2013-06-03 23:50 PDT, Kent Tamura 		no flags Details | Formatted Diff | Diff
Patch for landing (4.32 KB, patch)
2013-06-04 00:12 PDT, Kent Tamura 		no flags Details | Formatted Diff | Diff
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Ryosuke Niwa 2013-05-20 19:45:01 PDT 
Merge https://chromium.googlesource.com/chromium/blink/+/a0f5a1c5a050249d3f1be10249a91d88cd18c684

Range::textNodeSplit is called in Text::splitText, and it assumes the next sibling
node is still a Text node. A DOM mutation event handler can break this assumption.

We had better postpone DOM mutation events dispatched in Node::insertBefore
until exiting splitText to avoid inconsistent Range state.
Comment 1 Kent Tamura 2013-06-03 23:50:32 PDT 
Created attachment 203655 [details]
Patch
Comment 2 Kent Tamura 2013-06-04 00:12:04 PDT 
Created attachment 203659 [details]
Patch for landing

ChangeLog nits
Comment 3 WebKit Commit Bot 2013-06-04 01:10:11 PDT 
Comment on attachment 203659 [details]
Patch for landing

Clearing flags on attachment: 203659

Committed r151160: <http://trac.webkit.org/changeset/151160>
Comment 4 WebKit Commit Bot 2013-06-04 01:10:13 PDT 
All reviewed patches have been landed.  Closing bug.
Comment 5 Ahmad Saleem 2024-01-19 05:56:33 PST 
*** Bug 116073 has been marked as a duplicate of this bug. ***