Created attachment 374922 [details] Demo Moving to the right by word boundary immediately before a word boundary causes a hang. <rdar://problem/53285794>
Created attachment 374928 [details] Fixes the hang
Is שלום עולם the right way to say "hello world" in Hebrew?
Some analysis: 7/24/19, 8:10 PM Ryosuke Niwa: We’re stuck in wordBreakIteratorForMinOffsetBoundary with previousBox pointing to the inline box of the object, and previousBox->renderer() being at the br element after the object element. 7/24/19, 8:19 PM Ryosuke Niwa: So the problem here is that previousTextOrLineBreakBox never returns a box for the line consisting only of the object element. 7/24/19, 8:22 PM Ryosuke Niwa: Ugh… scratch that. We’re returning the line box for the object element. 7/24/19, 8:35 PM Ryosuke Niwa: Okay, in logicallyPreviousBox(~, br’s inline box, previousBoxInDifferentLine=true, ~), previousTextOrLineBreakBox doesn’t return the inline box for the object element, and previousTextOrLineBreakBox finds nothing since there is no more inline box left above the object element in this block flow. 7/25/19, 3:07 PM Ryosuke Niwa: Hm… so there is something confusing happening here. We’re trying to find the previous position at the beginning of “world” which appears object & br elements. The previous box is that of br element but VisiblePosition points to the beginning of “world”. As a result, when we get to previousRootInlineBoxCandidatePosition, we think previousNode, which is object element and br element are in different lines (which is correct). So, we’d return the position after the object element from previousRootInlineBoxCandidatePosition. Then previousRoot is pointing at the root inline box of the line which contains the object & br elements. Now, previousTextOrLineBreakBox is called with this root box with box=0, resulting in the inlinebox for BR to be returned. We’re back to where we were.
Created attachment 374929 [details] Added a change log
Comment on attachment 374929 [details] Added a change log Clearing flags on attachment: 374929 Committed r247881: <https://trac.webkit.org/changeset/247881>
All reviewed patches have been landed. Closing bug.