There are numerous bugs and security vulnerabilities due to first-letter / RenderTextFragment being so exotic to the rest of render objects. We should make RenderTextFragment act like the rest of rendering objects. Namely, it should own regular children instead of holding a special pointer for first-letter.
This will fix almost all crashes and bugs related to first-letter in WebCore/editing.
Yesssss! This was the conclusion I drew in my own frustration dealing with first-letter and editing. Seeing these problems continue to crop up really drives the issue home. I'm happy to work on this.
Thanks a lot Levi and Ryosuke.
There are 2 possible approaches:
1. Keep RenderTextFragment inherit from RenderText. In this approach, RenderTextFragment will act like RenderText and we can work-around most of issues in editing by adding a method to return the entire text instead "everything but first letter".
The problem with this approach is that renderes of inline text boxes will still be that of internal RenderText unless we wrap renderer() as well.
2. Make RenderTextFragment a render inline. In this approach, we'll reimplement first-letter and act like anonymous node that contains two RenderText.
There are a lot of uncertainlies and risks but the biggest problem is that Text DOM nodes's renderer() will no longer return RenderText. It might complicate many logics in editing and accessibility in addition to rendering, hit testing, and caret rendering, etc...
I talked with Ryosuke about this a bit. In my opinion, the first approach is viable and worthy of a proof of concept to make sure it's not out of the scope we think it is. I worry option 2 would be too invasive, kind of like getting the current first-letter implementation to work properly :)
Created attachment 147509 [details]
Basic WIP patch.