New issue
Advanced search Search tips

Issue 606499 link

Starred by 2 users
Status: Fixed
Owner:
yosin@chromium.org
Closed: Jun 2016
Cc:
editing-dev@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug

Blocked on:
issue 625533


Sign in to add a comment

CHECK failed: isBeforeChildren() || isAfterChildren(). afterAnchor in Position.c

Project Member Reported by ClusterFuzz, Apr 25 2016 
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6558797807484928

Fuzzer: mbarbella_js_mutation_layout
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  CHECK failed: isBeforeChildren() || isAfterChildren(). afterAnchor in Position.c
  blink::PositionTemplate<>::PositionTemplate
  blink::PositionIteratorAlgorithm<>::computePosition
  

Minimized Testcase (0.16 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv95-KvN4BZJkhhYOXFROIYE4k-G0-ydNRwqsBDOpLJtqgZqNty_v41djDN5qPsnmTyjKb--QLV_bMZh1y6fwVpiIBf_aPhgYXV0hU4irVbTNFcJ8SqUb-95Sfq-3U5mHCZk4bIEFA_yGudrwQp3VZm_RuV-Y7A
<!-->
<!-->
  <script>
window.onload = function() {
    var __v_159 = window.getSelection();
    __v_159.selectAllChildren(document);
    document.open();
}
</script>


Filer: manoranjanr

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Comment 1 by manoranj...@chromium.org, Apr 25 2016

Components: Tools>Test>FindIt>NoResult Blink
Labels: Te-Logged
Owner: yosin@chromium.org
Status: Assigned (was: Available)
yosin@, could you please look into this change: https://chromium.googlesource.com/chromium/src/+/8fb3a58481c1f024f726b7903b4cf8588fdd44d3%5E%21/third_party/WebKit/Source/core/editing/Position.cpp if possible?

Thank you!

Comment 2 by jianli@chromium.org, Apr 25 2016

Components: -Blink Blink>Editing

Comment 3 by yosin@chromium.org, Apr 28 2016

Status: Started (was: Assigned)
In review: http://crrev.com/1929453002

Comment 4 by yosin@chromium.org, Jun 10 2016

Status: Fixed (was: Started)
http://crrev.com/398519 fixed this too.
Project Member

Comment 5 by ClusterFuzz, Aug 11 2016 

ClusterFuzz has detected this issue as fixed in range 410916:411073.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6558797807484928

Fuzzer: mbarbella_js_mutation_layout
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  isBeforeChildren() || isAfterChildren(). afterAnchor in Position.cpp
  blink::PositionTemplate<>::PositionTemplate
  blink::PositionIteratorAlgorithm<>::computePosition
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=385386:385441
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=410916:411073

Minimized Testcase (0.16 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv97OTH7X-CiL2-19RYHUgfH2z290Zglhs-WBXyAEF6y_o-03vI7LfN-IITFRbXi1Sapm4dieABOJFE_mPqX5jWPnTfjaHdld-EMQCMl3iKxaatMOI9H_Ym3LYNDtGFnLAJzJ6Ae-WpizekGcSi3IoLLnyhlIJA?testcase_id=6558797807484928
<!-->
<!-->
  <script>
window.onload = function() {
    var __v_159 = window.getSelection();
    __v_159.selectAllChildren(document);
    document.open();
}
</script>


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 6 by bugdroid1@chromium.org, Oct 13 2016 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e7a92d5235ce35ad2f7127ebbefbcd357e569379

commit e7a92d5235ce35ad2f7127ebbefbcd357e569379
Author: yosin <yosin@chromium.org>
Date: Thu Oct 13 03:49:44 2016

Introduce Selection class

This patch introduces |Selection| class which is exclude visible position
canonicalization from |VisibleSelection|. The relation between |Selection| and
|VisibleSelection| is similar to |Position| and |VisiblePosition|.

This patch is a preparation of implementing lazy visible position
canonicalization on |FrameSelection|, http://crrev.com/1958093002

BUG= 139552 ,  603684 ,  606499 ,  625533 ,  644648 
TEST=run_webkit_unittests --gtest_filler=SelectionTest.*

Review-Url: https://codereview.chromium.org/2393403002
Cr-Commit-Position: refs/heads/master@{#424950}

[modify] https://crrev.com/e7a92d5235ce35ad2f7127ebbefbcd357e569379/third_party/WebKit/Source/core/BUILD.gn
[modify] https://crrev.com/e7a92d5235ce35ad2f7127ebbefbcd357e569379/third_party/WebKit/Source/core/editing/BUILD.gn
[add] https://crrev.com/e7a92d5235ce35ad2f7127ebbefbcd357e569379/third_party/WebKit/Source/core/editing/SelectionTemplate.cpp
[add] https://crrev.com/e7a92d5235ce35ad2f7127ebbefbcd357e569379/third_party/WebKit/Source/core/editing/SelectionTemplate.h
[add] https://crrev.com/e7a92d5235ce35ad2f7127ebbefbcd357e569379/third_party/WebKit/Source/core/editing/SelectionTemplateTest.cpp

Comment 7 by kateso...@chromium.org, Oct 18 2016

Components: -Tools>Test>FindIt>NoResult
Project Member

Comment 8 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 9 by yosin@chromium.org, Nov 28 2016

Blockedon: 625533
Project Member

Comment 10 by bugdroid1@chromium.org, Feb 13 2017 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/157413286770a7ac5a24c446a30c08f749738276

commit 157413286770a7ac5a24c446a30c08f749738276
Author: yosin <yosin@chromium.org>
Date: Mon Feb 13 10:55:13 2017

Make FrameSelection to hold non-canonicalized DOM positions

This patch makes |FrameSelection| to hold non-canonicalized DOM positions in
|SelectionEditor| to align Selection API specification[1] for improving
interoperatbility[2].

Before this patch we holds selection as |VisibleSelection| as canonicalized
DOM positions. This behavior is not align with Selection API specification[1]
then the most complained issue of Blink from editing-tf@w3c.

The heart of this patch is holding selection as |SelectionInDOMTree| and
compute |VisibleSelection| on-demand with cache of computed |VisibleSelection|.

|VisibleSelection| cache is invalidate each DOM tree change and style change
since canonicalization referes CSS style properties, e.g display, visibility,
-webkit-user-modify, etc, and layout dimension.

|SelectionEditor| utilizes |SynchronousMutationObserver| to relocate
|m_selectionInDOMTree| instead of |FrameSelection|. Before this patch
|FrameSelection| relocates |VisibleSelection| with dirty layout tree then
sets |FrameSelection::setSelection()|. To void cyclic reference between
|FrameSelection| and |SelectionEditor|, we could not move relocation part to
|SelectionEditor|.

This patch also updates
|FrameSelection::updatePostionAfterAdoptingTextNodesMerged()| to handle
|PositonAnchorType|.

# Highlight of changes
## FrameCaret
- Compute caret position after "layout clean" rather than each selection change
to align rendering pipeline.

## CharacterData
Changes timing of notifying character data update for ease of relocation of
positions.

## FrameSelection
- Move |m_isHandleVisible| to |SelectionInDOMTree| as follow-up of [5].
- Move selection relocation to |SelectionEditor|; following patch will move
implementations to "SelectionEditor.cpp"

## SelecitonEdtior
- Make it to hold |SelectionInDOMTree| with relocation at DOM mutation.
- Caching |VisibleSelection|

# Brief description of test expectation changes:
## ImeTest.java:
This patch gets rid of redundant selection change event from
 - |testImePaste|,
 - |testContentEditableEvents_DeleteSurroundingText|
 - |testInputTextEvents_DeleteSurroundingText|

## LayoutTests
Before this patch, Blink uses |VisibleSelection| when it sets even if style and
layout changed. This is wrong and unexpected behavior since positions in
|VisibleSelection| can no longer be canonicalized positions. This patch changes
this behavior to return "sane" canonicalized positions with clean style and
layout tree.

This patch is the result of many attempts. Previous changes can be found in
[3][4].

[1] https://www.w3.org/TR/selection-api/ W3C Selection API
[2] https://goo.gl/9v1zOK Improving Interoperatbility of Selection
[3] http://crrev.com/1958093002
[4] http://crrev.com/2637013002
[5] http://crrev.com/2651803007 Added isHandleVisible to |SelectionTemplate|

BUG= 139552 ,  603684 ,  605499 ,  606499 ,  625533 ,  644648 ,  679991 
TEST=See changes in this patch
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2

Review-Url: https://codereview.chromium.org/2680943004
Cr-Commit-Position: refs/heads/master@{#449928}

[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/content/public/android/javatests/src/org/chromium/content/browser/input/ImeTest.java
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/TestExpectations
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/editing/execCommand/crash-indenting-list-item.html
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/editing/execCommand/crash-inserting-list.html
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/editing/execCommand/format-block-multiple-paragraphs-in-pre.html
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/editing/execCommand/remove_format_and_extract_contents.html
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/editing/selection/character-data-mutation.html
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/editing/selection/document-mutation.html
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/editing/selection/select_all/select_all_details_crash.html
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/editing/selection/select_all/select_all_iframe_crash.html
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/editing/selection/selection_remove_children.html
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/editing/style/justify-left-crash.html
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/editing/undo/redo-selection-modify-crash.html
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/fast/dom/delete-contents.html
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/fast/dom/shadow/selection-in-nested-shadow.html
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/fast/dynamic/move-node-with-selection.html
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/fast/events/drag_and_drop_into_removed_on_focus.html
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/images/element-gcd-while-generating-alt-content-expected.txt
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/platform/mac/fast/css/first-letter-rtc-crash-expected.txt
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/platform/win/fast/css/first-letter-rtc-crash-expected.txt
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/svg/foreignObject/viewport-foreignobject-crash-expected.html
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/Source/core/editing/FrameCaret.cpp
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/Source/core/editing/FrameCaret.h
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/Source/core/editing/FrameSelection.cpp
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/Source/core/editing/FrameSelection.h
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/Source/core/editing/FrameSelectionTest.cpp
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/Source/core/editing/SelectionEditor.cpp
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/Source/core/editing/SelectionEditor.h
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/Source/core/editing/VisibleSelection.cpp
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/Source/core/frame/FrameView.cpp
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/Source/core/page/FocusController.cpp
Project Member

Comment 11 by bugdroid1@chromium.org, Feb 13 2017 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/47591962f15392d4af5eb1f69f3b79a8e2990947

commit 47591962f15392d4af5eb1f69f3b79a8e2990947
Author: gcasto <gcasto@chromium.org>
Date: Mon Feb 13 18:25:57 2017

Revert of Make FrameSelection to hold non-canonicalized positions (patchset #9 id:180001 of https://codereview.chromium.org/2680943004/ )

Reason for revert:
This patch looks like it is causing failures in editing/execCommand/move-up-down-should-skip-hidden-elements.html on Windows 7 (https://uberchromegw.corp.google.com/i/chromium.webkit/builders/WebKit%20Win7%20%28dbg%29).

Original issue's description:
> Make FrameSelection to hold non-canonicalized DOM positions
>
> This patch makes |FrameSelection| to hold non-canonicalized DOM positions in
> |SelectionEditor| to align Selection API specification[1] for improving
> interoperatbility[2].
>
> Before this patch we holds selection as |VisibleSelection| as canonicalized
> DOM positions. This behavior is not align with Selection API specification[1]
> then the most complained issue of Blink from editing-tf@w3c.
>
> The heart of this patch is holding selection as |SelectionInDOMTree| and
> compute |VisibleSelection| on-demand with cache of computed |VisibleSelection|.
>
> |VisibleSelection| cache is invalidate each DOM tree change and style change
> since canonicalization referes CSS style properties, e.g display, visibility,
> -webkit-user-modify, etc, and layout dimension.
>
> |SelectionEditor| utilizes |SynchronousMutationObserver| to relocate
> |m_selectionInDOMTree| instead of |FrameSelection|. Before this patch
> |FrameSelection| relocates |VisibleSelection| with dirty layout tree then
> sets |FrameSelection::setSelection()|. To void cyclic reference between
> |FrameSelection| and |SelectionEditor|, we could not move relocation part to
> |SelectionEditor|.
>
> This patch also updates
> |FrameSelection::updatePostionAfterAdoptingTextNodesMerged()| to handle
> |PositonAnchorType|.
>
> # Highlight of changes
> ## FrameCaret
> - Compute caret position after "layout clean" rather than each selection change
> to align rendering pipeline.
>
> ## CharacterData
> Changes timing of notifying character data update for ease of relocation of
> positions.
>
> ## FrameSelection
> - Move |m_isHandleVisible| to |SelectionInDOMTree| as follow-up of [5].
> - Move selection relocation to |SelectionEditor|; following patch will move
> implementations to "SelectionEditor.cpp"
>
> ## SelecitonEdtior
> - Make it to hold |SelectionInDOMTree| with relocation at DOM mutation.
> - Caching |VisibleSelection|
>
> # Brief description of test expectation changes:
> ## ImeTest.java:
> This patch gets rid of redundant selection change event from
>  - |testImePaste|,
>  - |testContentEditableEvents_DeleteSurroundingText|
>  - |testInputTextEvents_DeleteSurroundingText|
>
> ## LayoutTests
> Before this patch, Blink uses |VisibleSelection| when it sets even if style and
> layout changed. This is wrong and unexpected behavior since positions in
> |VisibleSelection| can no longer be canonicalized positions. This patch changes
> this behavior to return "sane" canonicalized positions with clean style and
> layout tree.
>
> This patch is the result of many attempts. Previous changes can be found in
> [3][4].
>
> [1] https://www.w3.org/TR/selection-api/ W3C Selection API
> [2] https://goo.gl/9v1zOK Improving Interoperatbility of Selection
> [3] http://crrev.com/1958093002
> [4] http://crrev.com/2637013002
> [5] http://crrev.com/2651803007 Added isHandleVisible to |SelectionTemplate|
>
> BUG= 139552 ,  603684 ,  605499 ,  606499 ,  625533 ,  644648 ,  679991 
> TEST=See changes in this patch
> CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
>
> Review-Url: https://codereview.chromium.org/2680943004
> Cr-Commit-Position: refs/heads/master@{#449928}
> Committed: https://chromium.googlesource.com/chromium/src/+/157413286770a7ac5a24c446a30c08f749738276

TBR=tkent@chromium.org,changwan@chromium.org,xiaochengh@chromium.org,yoichio@chromium.org,yosin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG= 139552 ,  603684 ,  605499 ,  606499 ,  625533 ,  644648 ,  679991 

Review-Url: https://codereview.chromium.org/2694823002
Cr-Commit-Position: refs/heads/master@{#450018}

[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/content/public/android/javatests/src/org/chromium/content/browser/input/ImeTest.java
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/editing/execCommand/crash-indenting-list-item.html
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/editing/execCommand/crash-inserting-list.html
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/editing/execCommand/format-block-multiple-paragraphs-in-pre.html
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/editing/execCommand/remove_format_and_extract_contents.html
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/editing/selection/character-data-mutation.html
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/editing/selection/document-mutation.html
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/editing/selection/select_all/select_all_details_crash.html
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/editing/selection/select_all/select_all_iframe_crash.html
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/editing/selection/selection_remove_children.html
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/editing/style/justify-left-crash.html
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/editing/undo/redo-selection-modify-crash.html
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/fast/dom/delete-contents.html
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/fast/dom/shadow/selection-in-nested-shadow.html
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/fast/dynamic/move-node-with-selection.html
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/fast/events/drag_and_drop_into_removed_on_focus.html
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/images/element-gcd-while-generating-alt-content-expected.txt
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/platform/mac/fast/css/first-letter-rtc-crash-expected.txt
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/platform/win/fast/css/first-letter-rtc-crash-expected.txt
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/svg/foreignObject/viewport-foreignobject-crash-expected.html
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/Source/core/editing/FrameCaret.cpp
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/Source/core/editing/FrameCaret.h
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/Source/core/editing/FrameSelection.cpp
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/Source/core/editing/FrameSelection.h
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/Source/core/editing/FrameSelectionTest.cpp
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/Source/core/editing/SelectionEditor.cpp
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/Source/core/editing/SelectionEditor.h
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/Source/core/editing/VisibleSelection.cpp
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/Source/core/frame/FrameView.cpp
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/Source/core/page/FocusController.cpp
Project Member

Comment 12 by bugdroid1@chromium.org, Feb 14 2017 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/17c84b2b6519c821dc319e79f2a7a4508508e20f

commit 17c84b2b6519c821dc319e79f2a7a4508508e20f
Author: yosin <yosin@chromium.org>
Date: Tue Feb 14 06:34:37 2017

Make FrameSelection to hold non-canonicalized DOM positions

This patch makes |FrameSelection| to hold non-canonicalized DOM positions in
|SelectionEditor| to align Selection API specification[1] for improving
interoperatbility[2].

Before this patch we holds selection as |VisibleSelection| as canonicalized
DOM positions. This behavior is not align with Selection API specification[1]
then the most complained issue of Blink from editing-tf@w3c.

The heart of this patch is holding selection as |SelectionInDOMTree| and
compute |VisibleSelection| on-demand with cache of computed |VisibleSelection|.

|VisibleSelection| cache is invalidate each DOM tree change and style change
since canonicalization referes CSS style properties, e.g display, visibility,
-webkit-user-modify, etc, and layout dimension.

|SelectionEditor| utilizes |SynchronousMutationObserver| to relocate
|m_selectionInDOMTree| instead of |FrameSelection|. Before this patch
|FrameSelection| relocates |VisibleSelection| with dirty layout tree then
sets |FrameSelection::setSelection()|. To void cyclic reference between
|FrameSelection| and |SelectionEditor|, we could not move relocation part to
|SelectionEditor|.

This patch also updates
|FrameSelection::updatePostionAfterAdoptingTextNodesMerged()| to handle
|PositonAnchorType|.

# Highlight of changes
## FrameCaret
- Compute caret position after "layout clean" rather than each selection change
to align rendering pipeline.

## CharacterData
Changes timing of notifying character data update for ease of relocation of
positions.

## FrameSelection
- Move |m_isHandleVisible| to |SelectionInDOMTree| as follow-up of [5].
- Move selection relocation to |SelectionEditor|; following patch will move
implementations to "SelectionEditor.cpp"

## SelecitonEdtior
- Make it to hold |SelectionInDOMTree| with relocation at DOM mutation.
- Caching |VisibleSelection|

# Brief description of test expectation changes:
## ImeTest.java:
This patch gets rid of redundant selection change event from
 - |testImePaste|,
 - |testContentEditableEvents_DeleteSurroundingText|
 - |testInputTextEvents_DeleteSurroundingText|

## LayoutTests
Before this patch, Blink uses |VisibleSelection| when it sets even if style and
layout changed. This is wrong and unexpected behavior since positions in
|VisibleSelection| can no longer be canonicalized positions. This patch changes
this behavior to return "sane" canonicalized positions with clean style and
layout tree.

This patch is the result of many attempts. Previous changes can be found in
[3][4].

[1] https://www.w3.org/TR/selection-api/ W3C Selection API
[2] https://goo.gl/9v1zOK Improving Interoperatbility of Selection
[3] http://crrev.com/1958093002
[4] http://crrev.com/2637013002
[5] http://crrev.com/2651803007 Added isHandleVisible to |SelectionTemplate|

BUG= 139552 ,  603684 ,  605499 ,  606499 ,  625533 ,  644648 ,  679991 
TEST=See changes in this patch
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2

Review-Url: https://codereview.chromium.org/2680943004
Cr-Original-Commit-Position: refs/heads/master@{#449928}
Committed: https://chromium.googlesource.com/chromium/src/+/157413286770a7ac5a24c446a30c08f749738276
Review-Url: https://codereview.chromium.org/2680943004
Cr-Commit-Position: refs/heads/master@{#450280}

[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/content/public/android/javatests/src/org/chromium/content/browser/input/ImeTest.java
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/TestExpectations
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/editing/execCommand/crash-indenting-list-item.html
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/editing/execCommand/crash-inserting-list.html
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/editing/execCommand/format-block-multiple-paragraphs-in-pre.html
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/editing/execCommand/remove_format_and_extract_contents.html
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/editing/selection/character-data-mutation.html
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/editing/selection/document-mutation.html
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/editing/selection/select_all/select_all_details_crash.html
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/editing/selection/select_all/select_all_iframe_crash.html
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/editing/selection/selection_remove_children.html
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/editing/style/justify-left-crash.html
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/editing/undo/redo-selection-modify-crash.html
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/fast/dom/delete-contents.html
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/fast/dom/shadow/selection-in-nested-shadow.html
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/fast/dynamic/move-node-with-selection.html
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/fast/events/drag_and_drop_into_removed_on_focus.html
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/images/element-gcd-while-generating-alt-content-expected.txt
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/platform/mac/fast/css/first-letter-rtc-crash-expected.txt
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/platform/win/fast/css/first-letter-rtc-crash-expected.txt
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/svg/foreignObject/viewport-foreignobject-crash-expected.html
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/Source/core/editing/FrameCaret.cpp
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/Source/core/editing/FrameCaret.h
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/Source/core/editing/FrameSelection.cpp
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/Source/core/editing/FrameSelection.h
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/Source/core/editing/FrameSelectionTest.cpp
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/Source/core/editing/SelectionEditor.cpp
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/Source/core/editing/SelectionEditor.h
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/Source/core/editing/VisibleSelection.cpp
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/Source/core/frame/FrameView.cpp
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/Source/core/page/FocusController.cpp
Project Member

Comment 13 by bugdroid1@chromium.org, Feb 14 2017 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/8f2a1baf12aa71d59d72e24583983b8a6b78340a

commit 8f2a1baf12aa71d59d72e24583983b8a6b78340a
Author: tyoshino <tyoshino@chromium.org>
Date: Tue Feb 14 08:18:39 2017

Revert of Make FrameSelection to hold non-canonicalized positions (patchset #9 id:180001 of https://codereview.chromium.org/2680943004/ )

Reason for revert:
See https://codereview.chromium.org/2680943004/#msg70

Original issue's description:
> Make FrameSelection to hold non-canonicalized DOM positions
>
> This patch makes |FrameSelection| to hold non-canonicalized DOM positions in
> |SelectionEditor| to align Selection API specification[1] for improving
> interoperatbility[2].
>
> Before this patch we holds selection as |VisibleSelection| as canonicalized
> DOM positions. This behavior is not align with Selection API specification[1]
> then the most complained issue of Blink from editing-tf@w3c.
>
> The heart of this patch is holding selection as |SelectionInDOMTree| and
> compute |VisibleSelection| on-demand with cache of computed |VisibleSelection|.
>
> |VisibleSelection| cache is invalidate each DOM tree change and style change
> since canonicalization referes CSS style properties, e.g display, visibility,
> -webkit-user-modify, etc, and layout dimension.
>
> |SelectionEditor| utilizes |SynchronousMutationObserver| to relocate
> |m_selectionInDOMTree| instead of |FrameSelection|. Before this patch
> |FrameSelection| relocates |VisibleSelection| with dirty layout tree then
> sets |FrameSelection::setSelection()|. To void cyclic reference between
> |FrameSelection| and |SelectionEditor|, we could not move relocation part to
> |SelectionEditor|.
>
> This patch also updates
> |FrameSelection::updatePostionAfterAdoptingTextNodesMerged()| to handle
> |PositonAnchorType|.
>
> # Highlight of changes
> ## FrameCaret
> - Compute caret position after "layout clean" rather than each selection change
> to align rendering pipeline.
>
> ## CharacterData
> Changes timing of notifying character data update for ease of relocation of
> positions.
>
> ## FrameSelection
> - Move |m_isHandleVisible| to |SelectionInDOMTree| as follow-up of [5].
> - Move selection relocation to |SelectionEditor|; following patch will move
> implementations to "SelectionEditor.cpp"
>
> ## SelecitonEdtior
> - Make it to hold |SelectionInDOMTree| with relocation at DOM mutation.
> - Caching |VisibleSelection|
>
> # Brief description of test expectation changes:
> ## ImeTest.java:
> This patch gets rid of redundant selection change event from
>  - |testImePaste|,
>  - |testContentEditableEvents_DeleteSurroundingText|
>  - |testInputTextEvents_DeleteSurroundingText|
>
> ## LayoutTests
> Before this patch, Blink uses |VisibleSelection| when it sets even if style and
> layout changed. This is wrong and unexpected behavior since positions in
> |VisibleSelection| can no longer be canonicalized positions. This patch changes
> this behavior to return "sane" canonicalized positions with clean style and
> layout tree.
>
> This patch is the result of many attempts. Previous changes can be found in
> [3][4].
>
> [1] https://www.w3.org/TR/selection-api/ W3C Selection API
> [2] https://goo.gl/9v1zOK Improving Interoperatbility of Selection
> [3] http://crrev.com/1958093002
> [4] http://crrev.com/2637013002
> [5] http://crrev.com/2651803007 Added isHandleVisible to |SelectionTemplate|
>
> BUG= 139552 ,  603684 ,  605499 ,  606499 ,  625533 ,  644648 ,  679991 
> TEST=See changes in this patch
> CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
>
> Review-Url: https://codereview.chromium.org/2680943004
> Cr-Original-Commit-Position: refs/heads/master@{#449928}
> Committed: https://chromium.googlesource.com/chromium/src/+/157413286770a7ac5a24c446a30c08f749738276
> Review-Url: https://codereview.chromium.org/2680943004
> Cr-Commit-Position: refs/heads/master@{#450280}
> Committed: https://chromium.googlesource.com/chromium/src/+/17c84b2b6519c821dc319e79f2a7a4508508e20f

TBR=changwan@chromium.org,tkent@chromium.org,xiaochengh@chromium.org,yoichio@chromium.org,yosin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG= 139552 ,  603684 ,  605499 ,  606499 ,  625533 ,  644648 ,  679991 

Review-Url: https://codereview.chromium.org/2691243002
Cr-Commit-Position: refs/heads/master@{#450291}

[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/content/public/android/javatests/src/org/chromium/content/browser/input/ImeTest.java
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/TestExpectations
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/editing/execCommand/crash-indenting-list-item.html
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/editing/execCommand/crash-inserting-list.html
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/editing/execCommand/format-block-multiple-paragraphs-in-pre.html
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/editing/execCommand/remove_format_and_extract_contents.html
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/editing/selection/character-data-mutation.html
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/editing/selection/document-mutation.html
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/editing/selection/select_all/select_all_details_crash.html
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/editing/selection/select_all/select_all_iframe_crash.html
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/editing/selection/selection_remove_children.html
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/editing/style/justify-left-crash.html
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/editing/undo/redo-selection-modify-crash.html
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/fast/dom/delete-contents.html
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/fast/dom/shadow/selection-in-nested-shadow.html
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/fast/dynamic/move-node-with-selection.html
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/fast/events/drag_and_drop_into_removed_on_focus.html
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/images/element-gcd-while-generating-alt-content-expected.txt
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/platform/mac/fast/css/first-letter-rtc-crash-expected.txt
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/platform/win/fast/css/first-letter-rtc-crash-expected.txt
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/svg/foreignObject/viewport-foreignobject-crash-expected.html
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/Source/core/editing/FrameCaret.cpp
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/Source/core/editing/FrameCaret.h
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/Source/core/editing/FrameSelection.cpp
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/Source/core/editing/FrameSelection.h
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/Source/core/editing/FrameSelectionTest.cpp
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/Source/core/editing/SelectionEditor.cpp
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/Source/core/editing/SelectionEditor.h
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/Source/core/editing/VisibleSelection.cpp
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/Source/core/frame/FrameView.cpp
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/Source/core/page/FocusController.cpp
Project Member

Comment 14 by bugdroid1@chromium.org, Feb 14 2017 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/d892f9592860691ae9a782c12260c94ed6bd1a63

commit d892f9592860691ae9a782c12260c94ed6bd1a63
Author: yosin <yosin@chromium.org>
Date: Tue Feb 14 15:56:00 2017

Make FrameSelection to hold non-canonicalized DOM positions

This patch makes |FrameSelection| to hold non-canonicalized DOM positions in
|SelectionEditor| to align Selection API specification[1] for improving
interoperatbility[2].

Before this patch we holds selection as |VisibleSelection| as canonicalized
DOM positions. This behavior is not align with Selection API specification[1]
then the most complained issue of Blink from editing-tf@w3c.

The heart of this patch is holding selection as |SelectionInDOMTree| and
compute |VisibleSelection| on-demand with cache of computed |VisibleSelection|.

|VisibleSelection| cache is invalidate each DOM tree change and style change
since canonicalization referes CSS style properties, e.g display, visibility,
-webkit-user-modify, etc, and layout dimension.

|SelectionEditor| utilizes |SynchronousMutationObserver| to relocate
|m_selectionInDOMTree| instead of |FrameSelection|. Before this patch
|FrameSelection| relocates |VisibleSelection| with dirty layout tree then
sets |FrameSelection::setSelection()|. To void cyclic reference between
|FrameSelection| and |SelectionEditor|, we could not move relocation part to
|SelectionEditor|.

This patch also updates
|FrameSelection::updatePostionAfterAdoptingTextNodesMerged()| to handle
|PositonAnchorType|.

# Highlight of changes
## FrameCaret
- Compute caret position after "layout clean" rather than each selection change
to align rendering pipeline.

## CharacterData
Changes timing of notifying character data update for ease of relocation of
positions.

## FrameSelection
- Move |m_isHandleVisible| to |SelectionInDOMTree| as follow-up of [5].
- Move selection relocation to |SelectionEditor|; following patch will move
implementations to "SelectionEditor.cpp"

## SelecitonEdtior
- Make it to hold |SelectionInDOMTree| with relocation at DOM mutation.
- Caching |VisibleSelection|

# Brief description of test expectation changes:
## ImeTest.java:
This patch gets rid of redundant selection change event from
 - |testImePaste|,
 - |testContentEditableEvents_DeleteSurroundingText|
 - |testInputTextEvents_DeleteSurroundingText|

## LayoutTests
Before this patch, Blink uses |VisibleSelection| when it sets even if style and
layout changed. This is wrong and unexpected behavior since positions in
|VisibleSelection| can no longer be canonicalized positions. This patch changes
this behavior to return "sane" canonicalized positions with clean style and
layout tree.

This patch is the result of many attempts. Previous changes can be found in
[3][4].

[1] https://www.w3.org/TR/selection-api/ W3C Selection API
[2] https://goo.gl/9v1zOK Improving Interoperatbility of Selection
[3] http://crrev.com/1958093002
[4] http://crrev.com/2637013002
[5] http://crrev.com/2651803007 Added isHandleVisible to |SelectionTemplate|

BUG= 139552 ,  603684 ,  605499 ,  606499 ,  625533 ,  644648 ,  679991 
TEST=See changes in this patch
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2

Review-Url: https://codereview.chromium.org/2680943004
Cr-Original-Original-Commit-Position: refs/heads/master@{#449928}
Committed: https://chromium.googlesource.com/chromium/src/+/157413286770a7ac5a24c446a30c08f749738276
Review-Url: https://codereview.chromium.org/2680943004
Cr-Original-Commit-Position: refs/heads/master@{#450280}
Committed: https://chromium.googlesource.com/chromium/src/+/17c84b2b6519c821dc319e79f2a7a4508508e20f
Review-Url: https://codereview.chromium.org/2680943004
Cr-Commit-Position: refs/heads/master@{#450370}

[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/content/public/android/javatests/src/org/chromium/content/browser/input/ImeTest.java
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/TestExpectations
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/editing/deleting/delete-br-001-expected.txt
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/editing/deleting/delete-br-001.html
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/editing/deleting/delete-character-003-expected.txt
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/editing/deleting/delete-character-003.html
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/editing/execCommand/crash-indenting-list-item.html
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/editing/execCommand/crash-inserting-list.html
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/editing/execCommand/format-block-multiple-paragraphs-in-pre.html
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/editing/execCommand/remove_format_and_extract_contents.html
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/editing/selection/character-data-mutation.html
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/editing/selection/document-mutation.html
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/editing/selection/select_all/select_all_details_crash.html
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/editing/selection/select_all/select_all_iframe_crash.html
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/editing/selection/selection_remove_children.html
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/editing/style/justify-left-crash.html
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/editing/undo/redo-selection-modify-crash.html
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/external/wpt/selection/collapse-00-expected.txt
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/external/wpt/selection/collapse-30-expected.txt
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/external/wpt/selection/collapseToStartEnd-expected.txt
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/fast/dom/delete-contents.html
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/fast/dom/shadow/selection-in-nested-shadow.html
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/fast/dynamic/move-node-with-selection.html
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/fast/events/drag_and_drop_into_removed_on_focus.html
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/images/element-gcd-while-generating-alt-content-expected.txt
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/platform/mac/fast/css/first-letter-rtc-crash-expected.txt
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/platform/win/fast/css/first-letter-rtc-crash-expected.txt
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/svg/foreignObject/viewport-foreignobject-crash-expected.html
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/Source/core/editing/FrameCaret.cpp
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/Source/core/editing/FrameCaret.h
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/Source/core/editing/FrameSelection.cpp
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/Source/core/editing/FrameSelection.h
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/Source/core/editing/FrameSelectionTest.cpp
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/Source/core/editing/SelectionEditor.cpp
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/Source/core/editing/SelectionEditor.h
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/Source/core/editing/VisibleSelection.cpp
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/Source/core/frame/FrameView.cpp
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/Source/core/page/FocusController.cpp
►

Sign in to add a comment