Issue 644648 link

Starred by 3 users

Issue metadata

Status:	WontFix
Owner:	yosin@chromium.org
Closed:	Dec 2016
Cc:	█ ashej...@chromium.org editing-dev@chromium.org
Components:	Blink>Editing>Selection
EstimatedDays:	----
NextAction:	----
OS:	Linux
Pri:	1
Type:	Bug
Te-Logged Stability-Crash Reproducible M-55 Stability-Memory-AddressSanitizer Clusterfuzz

Blocked on:
issue 625533

Crash in blink::Node::containsIncludingHostElements

Project Member Reported by ClusterFuzz, Sep 7 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6550919879852032

Fuzzer: bj_broddelwerk
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000010
Crash State:
  blink::Node::containsIncludingHostElements
  blink::FrameSelection::nodeChildrenWillBeRemoved
  blink::Document::nodeChildrenWillBeRemoved
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=410916:411126

Minimized Testcase (1.79 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94ADXpOT8x4-_Uw8xqiQ8mpflf_FzWacFNRGsNzLrIh-1n_txMAgA41OakFPF26NM1hki0GEVfnBRPGIXDEVbg-LOy6CFIeCtHg7aAELWmpqhdRSHf01PQamoiWpN_8U_rOBJJrtCU1AWifzxOrOzoB-TFenw?testcase_id=6550919879852032

Issue manually filed by: ashejole

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Comment 1 by ashej...@chromium.org, Sep 7 2016

Cc: ashej...@chromium.org
Components: Blink>DOM Tools>Test>FindIt>CorrectResult
Labels: M-55 Te-Logged
Owner: yosin@chromium.org
Status: Assigned (was: Untriaged)

Suspected CLs	The result is a list of CLs that change the crashed files.

Author: yosin
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/6ffa8394ec09cac47f842e47f843ad13dc25feb2
Time: Wed Aug 10 06:11:30 2016
Files Document.cpp, FrameSelection.cpp are changed in this cl (and is part of stack frame #5, "blink::Document::nodeChildrenWillBeRemoved")
Minimum distance from crash line to modified line: 15. (file: Document.cpp, crashed on: 3813, modified: 3798).

Suspected Project: chromium
Suspected Component: Blink>DOM

Comment 2 by manoranj...@chromium.org, Sep 21 2016

yosin@, Gentle ping! could you please look into this?

Thank you!

Comment 3 by tkent@chromium.org, Sep 27 2016

Components: -Blink>DOM Blink>TextSelection

Comment 4 by yosin@chromium.org, Sep 27 2016

Status: Started (was: Assigned)

This should be fixed once lazy visible position is committed.

Comment 5 by tkent@chromium.org, Oct 12 2016

Components: -Blink>TextSelection Blink>Editing>Selection

Project Member

Comment 6 by bugdroid1@chromium.org, Oct 13 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e7a92d5235ce35ad2f7127ebbefbcd357e569379

commit e7a92d5235ce35ad2f7127ebbefbcd357e569379
Author: yosin <yosin@chromium.org>
Date: Thu Oct 13 03:49:44 2016

Introduce Selection class

This patch introduces |Selection| class which is exclude visible position
canonicalization from |VisibleSelection|. The relation between |Selection| and
|VisibleSelection| is similar to |Position| and |VisiblePosition|.

This patch is a preparation of implementing lazy visible position
canonicalization on |FrameSelection|, http://crrev.com/1958093002

BUG= 139552 ,  603684 ,  606499 ,  625533 ,  644648 
TEST=run_webkit_unittests --gtest_filler=SelectionTest.*

Review-Url: https://codereview.chromium.org/2393403002
Cr-Commit-Position: refs/heads/master@{#424950}

[modify] https://crrev.com/e7a92d5235ce35ad2f7127ebbefbcd357e569379/third_party/WebKit/Source/core/BUILD.gn
[modify] https://crrev.com/e7a92d5235ce35ad2f7127ebbefbcd357e569379/third_party/WebKit/Source/core/editing/BUILD.gn
[add] https://crrev.com/e7a92d5235ce35ad2f7127ebbefbcd357e569379/third_party/WebKit/Source/core/editing/SelectionTemplate.cpp
[add] https://crrev.com/e7a92d5235ce35ad2f7127ebbefbcd357e569379/third_party/WebKit/Source/core/editing/SelectionTemplate.h
[add] https://crrev.com/e7a92d5235ce35ad2f7127ebbefbcd357e569379/third_party/WebKit/Source/core/editing/SelectionTemplateTest.cpp

Project Member

Comment 7 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 8 by yosin@chromium.org, Nov 28 2016

Blockedon: 625533

Project Member

Comment 9 by ClusterFuzz, Dec 28 2016

Status: WontFix (was: Started)

ClusterFuzz testcase 6550919879852032 is flaky and no longer reproduces, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Project Member

Comment 10 by bugdroid1@chromium.org, Feb 13 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/157413286770a7ac5a24c446a30c08f749738276

commit 157413286770a7ac5a24c446a30c08f749738276
Author: yosin <yosin@chromium.org>
Date: Mon Feb 13 10:55:13 2017

Make FrameSelection to hold non-canonicalized DOM positions

This patch makes |FrameSelection| to hold non-canonicalized DOM positions in
|SelectionEditor| to align Selection API specification[1] for improving
interoperatbility[2].

Before this patch we holds selection as |VisibleSelection| as canonicalized
DOM positions. This behavior is not align with Selection API specification[1]
then the most complained issue of Blink from editing-tf@w3c.

The heart of this patch is holding selection as |SelectionInDOMTree| and
compute |VisibleSelection| on-demand with cache of computed |VisibleSelection|.

|VisibleSelection| cache is invalidate each DOM tree change and style change
since canonicalization referes CSS style properties, e.g display, visibility,
-webkit-user-modify, etc, and layout dimension.

|SelectionEditor| utilizes |SynchronousMutationObserver| to relocate
|m_selectionInDOMTree| instead of |FrameSelection|. Before this patch
|FrameSelection| relocates |VisibleSelection| with dirty layout tree then
sets |FrameSelection::setSelection()|. To void cyclic reference between
|FrameSelection| and |SelectionEditor|, we could not move relocation part to
|SelectionEditor|.

This patch also updates
|FrameSelection::updatePostionAfterAdoptingTextNodesMerged()| to handle
|PositonAnchorType|.

# Highlight of changes
## FrameCaret
- Compute caret position after "layout clean" rather than each selection change
to align rendering pipeline.

## CharacterData
Changes timing of notifying character data update for ease of relocation of
positions.

## FrameSelection
- Move |m_isHandleVisible| to |SelectionInDOMTree| as follow-up of [5].
- Move selection relocation to |SelectionEditor|; following patch will move
implementations to "SelectionEditor.cpp"

## SelecitonEdtior
- Make it to hold |SelectionInDOMTree| with relocation at DOM mutation.
- Caching |VisibleSelection|

# Brief description of test expectation changes:
## ImeTest.java:
This patch gets rid of redundant selection change event from
 - |testImePaste|,
 - |testContentEditableEvents_DeleteSurroundingText|
 - |testInputTextEvents_DeleteSurroundingText|

## LayoutTests
Before this patch, Blink uses |VisibleSelection| when it sets even if style and
layout changed. This is wrong and unexpected behavior since positions in
|VisibleSelection| can no longer be canonicalized positions. This patch changes
this behavior to return "sane" canonicalized positions with clean style and
layout tree.

This patch is the result of many attempts. Previous changes can be found in
[3][4].

[1] https://www.w3.org/TR/selection-api/ W3C Selection API
[2] https://goo.gl/9v1zOK Improving Interoperatbility of Selection
[3] http://crrev.com/1958093002
[4] http://crrev.com/2637013002
[5] http://crrev.com/2651803007 Added isHandleVisible to |SelectionTemplate|

BUG= 139552 ,  603684 ,  605499 ,  606499 ,  625533 ,  644648 ,  679991 
TEST=See changes in this patch
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2

Review-Url: https://codereview.chromium.org/2680943004
Cr-Commit-Position: refs/heads/master@{#449928}

[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/content/public/android/javatests/src/org/chromium/content/browser/input/ImeTest.java
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/TestExpectations
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/editing/execCommand/crash-indenting-list-item.html
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/editing/execCommand/crash-inserting-list.html
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/editing/execCommand/format-block-multiple-paragraphs-in-pre.html
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/editing/execCommand/remove_format_and_extract_contents.html
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/editing/selection/character-data-mutation.html
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/editing/selection/document-mutation.html
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/editing/selection/select_all/select_all_details_crash.html
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/editing/selection/select_all/select_all_iframe_crash.html
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/editing/selection/selection_remove_children.html
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/editing/style/justify-left-crash.html
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/editing/undo/redo-selection-modify-crash.html
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/fast/dom/delete-contents.html
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/fast/dom/shadow/selection-in-nested-shadow.html
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/fast/dynamic/move-node-with-selection.html
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/fast/events/drag_and_drop_into_removed_on_focus.html
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/images/element-gcd-while-generating-alt-content-expected.txt
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/platform/mac/fast/css/first-letter-rtc-crash-expected.txt
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/platform/win/fast/css/first-letter-rtc-crash-expected.txt
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/LayoutTests/svg/foreignObject/viewport-foreignobject-crash-expected.html
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/Source/core/editing/FrameCaret.cpp
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/Source/core/editing/FrameCaret.h
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/Source/core/editing/FrameSelection.cpp
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/Source/core/editing/FrameSelection.h
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/Source/core/editing/FrameSelectionTest.cpp
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/Source/core/editing/SelectionEditor.cpp
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/Source/core/editing/SelectionEditor.h
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/Source/core/editing/VisibleSelection.cpp
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/Source/core/frame/FrameView.cpp
[modify] https://crrev.com/157413286770a7ac5a24c446a30c08f749738276/third_party/WebKit/Source/core/page/FocusController.cpp

Project Member

Comment 11 by bugdroid1@chromium.org, Feb 13 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/47591962f15392d4af5eb1f69f3b79a8e2990947

commit 47591962f15392d4af5eb1f69f3b79a8e2990947
Author: gcasto <gcasto@chromium.org>
Date: Mon Feb 13 18:25:57 2017

Revert of Make FrameSelection to hold non-canonicalized positions (patchset #9 id:180001 of https://codereview.chromium.org/2680943004/ )

Reason for revert:
This patch looks like it is causing failures in editing/execCommand/move-up-down-should-skip-hidden-elements.html on Windows 7 (https://uberchromegw.corp.google.com/i/chromium.webkit/builders/WebKit%20Win7%20%28dbg%29).

Original issue's description:
> Make FrameSelection to hold non-canonicalized DOM positions
>
> This patch makes |FrameSelection| to hold non-canonicalized DOM positions in
> |SelectionEditor| to align Selection API specification[1] for improving
> interoperatbility[2].
>
> Before this patch we holds selection as |VisibleSelection| as canonicalized
> DOM positions. This behavior is not align with Selection API specification[1]
> then the most complained issue of Blink from editing-tf@w3c.
>
> The heart of this patch is holding selection as |SelectionInDOMTree| and
> compute |VisibleSelection| on-demand with cache of computed |VisibleSelection|.
>
> |VisibleSelection| cache is invalidate each DOM tree change and style change
> since canonicalization referes CSS style properties, e.g display, visibility,
> -webkit-user-modify, etc, and layout dimension.
>
> |SelectionEditor| utilizes |SynchronousMutationObserver| to relocate
> |m_selectionInDOMTree| instead of |FrameSelection|. Before this patch
> |FrameSelection| relocates |VisibleSelection| with dirty layout tree then
> sets |FrameSelection::setSelection()|. To void cyclic reference between
> |FrameSelection| and |SelectionEditor|, we could not move relocation part to
> |SelectionEditor|.
>
> This patch also updates
> |FrameSelection::updatePostionAfterAdoptingTextNodesMerged()| to handle
> |PositonAnchorType|.
>
> # Highlight of changes
> ## FrameCaret
> - Compute caret position after "layout clean" rather than each selection change
> to align rendering pipeline.
>
> ## CharacterData
> Changes timing of notifying character data update for ease of relocation of
> positions.
>
> ## FrameSelection
> - Move |m_isHandleVisible| to |SelectionInDOMTree| as follow-up of [5].
> - Move selection relocation to |SelectionEditor|; following patch will move
> implementations to "SelectionEditor.cpp"
>
> ## SelecitonEdtior
> - Make it to hold |SelectionInDOMTree| with relocation at DOM mutation.
> - Caching |VisibleSelection|
>
> # Brief description of test expectation changes:
> ## ImeTest.java:
> This patch gets rid of redundant selection change event from
>  - |testImePaste|,
>  - |testContentEditableEvents_DeleteSurroundingText|
>  - |testInputTextEvents_DeleteSurroundingText|
>
> ## LayoutTests
> Before this patch, Blink uses |VisibleSelection| when it sets even if style and
> layout changed. This is wrong and unexpected behavior since positions in
> |VisibleSelection| can no longer be canonicalized positions. This patch changes
> this behavior to return "sane" canonicalized positions with clean style and
> layout tree.
>
> This patch is the result of many attempts. Previous changes can be found in
> [3][4].
>
> [1] https://www.w3.org/TR/selection-api/ W3C Selection API
> [2] https://goo.gl/9v1zOK Improving Interoperatbility of Selection
> [3] http://crrev.com/1958093002
> [4] http://crrev.com/2637013002
> [5] http://crrev.com/2651803007 Added isHandleVisible to |SelectionTemplate|
>
> BUG= 139552 ,  603684 ,  605499 ,  606499 ,  625533 ,  644648 ,  679991 
> TEST=See changes in this patch
> CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
>
> Review-Url: https://codereview.chromium.org/2680943004
> Cr-Commit-Position: refs/heads/master@{#449928}
> Committed: https://chromium.googlesource.com/chromium/src/+/157413286770a7ac5a24c446a30c08f749738276

TBR=tkent@chromium.org,changwan@chromium.org,xiaochengh@chromium.org,yoichio@chromium.org,yosin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG= 139552 ,  603684 ,  605499 ,  606499 ,  625533 ,  644648 ,  679991 

Review-Url: https://codereview.chromium.org/2694823002
Cr-Commit-Position: refs/heads/master@{#450018}

[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/content/public/android/javatests/src/org/chromium/content/browser/input/ImeTest.java
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/editing/execCommand/crash-indenting-list-item.html
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/editing/execCommand/crash-inserting-list.html
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/editing/execCommand/format-block-multiple-paragraphs-in-pre.html
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/editing/execCommand/remove_format_and_extract_contents.html
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/editing/selection/character-data-mutation.html
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/editing/selection/document-mutation.html
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/editing/selection/select_all/select_all_details_crash.html
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/editing/selection/select_all/select_all_iframe_crash.html
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/editing/selection/selection_remove_children.html
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/editing/style/justify-left-crash.html
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/editing/undo/redo-selection-modify-crash.html
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/fast/dom/delete-contents.html
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/fast/dom/shadow/selection-in-nested-shadow.html
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/fast/dynamic/move-node-with-selection.html
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/fast/events/drag_and_drop_into_removed_on_focus.html
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/images/element-gcd-while-generating-alt-content-expected.txt
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/platform/mac/fast/css/first-letter-rtc-crash-expected.txt
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/platform/win/fast/css/first-letter-rtc-crash-expected.txt
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/LayoutTests/svg/foreignObject/viewport-foreignobject-crash-expected.html
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/Source/core/editing/FrameCaret.cpp
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/Source/core/editing/FrameCaret.h
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/Source/core/editing/FrameSelection.cpp
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/Source/core/editing/FrameSelection.h
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/Source/core/editing/FrameSelectionTest.cpp
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/Source/core/editing/SelectionEditor.cpp
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/Source/core/editing/SelectionEditor.h
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/Source/core/editing/VisibleSelection.cpp
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/Source/core/frame/FrameView.cpp
[modify] https://crrev.com/47591962f15392d4af5eb1f69f3b79a8e2990947/third_party/WebKit/Source/core/page/FocusController.cpp

Project Member

Comment 12 by bugdroid1@chromium.org, Feb 14 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/17c84b2b6519c821dc319e79f2a7a4508508e20f

commit 17c84b2b6519c821dc319e79f2a7a4508508e20f
Author: yosin <yosin@chromium.org>
Date: Tue Feb 14 06:34:37 2017

Make FrameSelection to hold non-canonicalized DOM positions

This patch makes |FrameSelection| to hold non-canonicalized DOM positions in
|SelectionEditor| to align Selection API specification[1] for improving
interoperatbility[2].

Before this patch we holds selection as |VisibleSelection| as canonicalized
DOM positions. This behavior is not align with Selection API specification[1]
then the most complained issue of Blink from editing-tf@w3c.

The heart of this patch is holding selection as |SelectionInDOMTree| and
compute |VisibleSelection| on-demand with cache of computed |VisibleSelection|.

|VisibleSelection| cache is invalidate each DOM tree change and style change
since canonicalization referes CSS style properties, e.g display, visibility,
-webkit-user-modify, etc, and layout dimension.

|SelectionEditor| utilizes |SynchronousMutationObserver| to relocate
|m_selectionInDOMTree| instead of |FrameSelection|. Before this patch
|FrameSelection| relocates |VisibleSelection| with dirty layout tree then
sets |FrameSelection::setSelection()|. To void cyclic reference between
|FrameSelection| and |SelectionEditor|, we could not move relocation part to
|SelectionEditor|.

This patch also updates
|FrameSelection::updatePostionAfterAdoptingTextNodesMerged()| to handle
|PositonAnchorType|.

# Highlight of changes
## FrameCaret
- Compute caret position after "layout clean" rather than each selection change
to align rendering pipeline.

## CharacterData
Changes timing of notifying character data update for ease of relocation of
positions.

## FrameSelection
- Move |m_isHandleVisible| to |SelectionInDOMTree| as follow-up of [5].
- Move selection relocation to |SelectionEditor|; following patch will move
implementations to "SelectionEditor.cpp"

## SelecitonEdtior
- Make it to hold |SelectionInDOMTree| with relocation at DOM mutation.
- Caching |VisibleSelection|

# Brief description of test expectation changes:
## ImeTest.java:
This patch gets rid of redundant selection change event from
 - |testImePaste|,
 - |testContentEditableEvents_DeleteSurroundingText|
 - |testInputTextEvents_DeleteSurroundingText|

## LayoutTests
Before this patch, Blink uses |VisibleSelection| when it sets even if style and
layout changed. This is wrong and unexpected behavior since positions in
|VisibleSelection| can no longer be canonicalized positions. This patch changes
this behavior to return "sane" canonicalized positions with clean style and
layout tree.

This patch is the result of many attempts. Previous changes can be found in
[3][4].

[1] https://www.w3.org/TR/selection-api/ W3C Selection API
[2] https://goo.gl/9v1zOK Improving Interoperatbility of Selection
[3] http://crrev.com/1958093002
[4] http://crrev.com/2637013002
[5] http://crrev.com/2651803007 Added isHandleVisible to |SelectionTemplate|

BUG= 139552 ,  603684 ,  605499 ,  606499 ,  625533 ,  644648 ,  679991 
TEST=See changes in this patch
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2

Review-Url: https://codereview.chromium.org/2680943004
Cr-Original-Commit-Position: refs/heads/master@{#449928}
Committed: https://chromium.googlesource.com/chromium/src/+/157413286770a7ac5a24c446a30c08f749738276
Review-Url: https://codereview.chromium.org/2680943004
Cr-Commit-Position: refs/heads/master@{#450280}

[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/content/public/android/javatests/src/org/chromium/content/browser/input/ImeTest.java
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/TestExpectations
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/editing/execCommand/crash-indenting-list-item.html
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/editing/execCommand/crash-inserting-list.html
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/editing/execCommand/format-block-multiple-paragraphs-in-pre.html
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/editing/execCommand/remove_format_and_extract_contents.html
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/editing/selection/character-data-mutation.html
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/editing/selection/document-mutation.html
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/editing/selection/select_all/select_all_details_crash.html
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/editing/selection/select_all/select_all_iframe_crash.html
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/editing/selection/selection_remove_children.html
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/editing/style/justify-left-crash.html
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/editing/undo/redo-selection-modify-crash.html
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/fast/dom/delete-contents.html
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/fast/dom/shadow/selection-in-nested-shadow.html
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/fast/dynamic/move-node-with-selection.html
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/fast/events/drag_and_drop_into_removed_on_focus.html
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/images/element-gcd-while-generating-alt-content-expected.txt
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/platform/mac/fast/css/first-letter-rtc-crash-expected.txt
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/platform/win/fast/css/first-letter-rtc-crash-expected.txt
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/LayoutTests/svg/foreignObject/viewport-foreignobject-crash-expected.html
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/Source/core/editing/FrameCaret.cpp
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/Source/core/editing/FrameCaret.h
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/Source/core/editing/FrameSelection.cpp
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/Source/core/editing/FrameSelection.h
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/Source/core/editing/FrameSelectionTest.cpp
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/Source/core/editing/SelectionEditor.cpp
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/Source/core/editing/SelectionEditor.h
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/Source/core/editing/VisibleSelection.cpp
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/Source/core/frame/FrameView.cpp
[modify] https://crrev.com/17c84b2b6519c821dc319e79f2a7a4508508e20f/third_party/WebKit/Source/core/page/FocusController.cpp

Project Member

Comment 13 by bugdroid1@chromium.org, Feb 14 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/8f2a1baf12aa71d59d72e24583983b8a6b78340a

commit 8f2a1baf12aa71d59d72e24583983b8a6b78340a
Author: tyoshino <tyoshino@chromium.org>
Date: Tue Feb 14 08:18:39 2017

Revert of Make FrameSelection to hold non-canonicalized positions (patchset #9 id:180001 of https://codereview.chromium.org/2680943004/ )

Reason for revert:
See https://codereview.chromium.org/2680943004/#msg70

Original issue's description:
> Make FrameSelection to hold non-canonicalized DOM positions
>
> This patch makes |FrameSelection| to hold non-canonicalized DOM positions in
> |SelectionEditor| to align Selection API specification[1] for improving
> interoperatbility[2].
>
> Before this patch we holds selection as |VisibleSelection| as canonicalized
> DOM positions. This behavior is not align with Selection API specification[1]
> then the most complained issue of Blink from editing-tf@w3c.
>
> The heart of this patch is holding selection as |SelectionInDOMTree| and
> compute |VisibleSelection| on-demand with cache of computed |VisibleSelection|.
>
> |VisibleSelection| cache is invalidate each DOM tree change and style change
> since canonicalization referes CSS style properties, e.g display, visibility,
> -webkit-user-modify, etc, and layout dimension.
>
> |SelectionEditor| utilizes |SynchronousMutationObserver| to relocate
> |m_selectionInDOMTree| instead of |FrameSelection|. Before this patch
> |FrameSelection| relocates |VisibleSelection| with dirty layout tree then
> sets |FrameSelection::setSelection()|. To void cyclic reference between
> |FrameSelection| and |SelectionEditor|, we could not move relocation part to
> |SelectionEditor|.
>
> This patch also updates
> |FrameSelection::updatePostionAfterAdoptingTextNodesMerged()| to handle
> |PositonAnchorType|.
>
> # Highlight of changes
> ## FrameCaret
> - Compute caret position after "layout clean" rather than each selection change
> to align rendering pipeline.
>
> ## CharacterData
> Changes timing of notifying character data update for ease of relocation of
> positions.
>
> ## FrameSelection
> - Move |m_isHandleVisible| to |SelectionInDOMTree| as follow-up of [5].
> - Move selection relocation to |SelectionEditor|; following patch will move
> implementations to "SelectionEditor.cpp"
>
> ## SelecitonEdtior
> - Make it to hold |SelectionInDOMTree| with relocation at DOM mutation.
> - Caching |VisibleSelection|
>
> # Brief description of test expectation changes:
> ## ImeTest.java:
> This patch gets rid of redundant selection change event from
>  - |testImePaste|,
>  - |testContentEditableEvents_DeleteSurroundingText|
>  - |testInputTextEvents_DeleteSurroundingText|
>
> ## LayoutTests
> Before this patch, Blink uses |VisibleSelection| when it sets even if style and
> layout changed. This is wrong and unexpected behavior since positions in
> |VisibleSelection| can no longer be canonicalized positions. This patch changes
> this behavior to return "sane" canonicalized positions with clean style and
> layout tree.
>
> This patch is the result of many attempts. Previous changes can be found in
> [3][4].
>
> [1] https://www.w3.org/TR/selection-api/ W3C Selection API
> [2] https://goo.gl/9v1zOK Improving Interoperatbility of Selection
> [3] http://crrev.com/1958093002
> [4] http://crrev.com/2637013002
> [5] http://crrev.com/2651803007 Added isHandleVisible to |SelectionTemplate|
>
> BUG= 139552 ,  603684 ,  605499 ,  606499 ,  625533 ,  644648 ,  679991 
> TEST=See changes in this patch
> CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
>
> Review-Url: https://codereview.chromium.org/2680943004
> Cr-Original-Commit-Position: refs/heads/master@{#449928}
> Committed: https://chromium.googlesource.com/chromium/src/+/157413286770a7ac5a24c446a30c08f749738276
> Review-Url: https://codereview.chromium.org/2680943004
> Cr-Commit-Position: refs/heads/master@{#450280}
> Committed: https://chromium.googlesource.com/chromium/src/+/17c84b2b6519c821dc319e79f2a7a4508508e20f

TBR=changwan@chromium.org,tkent@chromium.org,xiaochengh@chromium.org,yoichio@chromium.org,yosin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG= 139552 ,  603684 ,  605499 ,  606499 ,  625533 ,  644648 ,  679991 

Review-Url: https://codereview.chromium.org/2691243002
Cr-Commit-Position: refs/heads/master@{#450291}

[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/content/public/android/javatests/src/org/chromium/content/browser/input/ImeTest.java
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/TestExpectations
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/editing/execCommand/crash-indenting-list-item.html
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/editing/execCommand/crash-inserting-list.html
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/editing/execCommand/format-block-multiple-paragraphs-in-pre.html
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/editing/execCommand/remove_format_and_extract_contents.html
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/editing/selection/character-data-mutation.html
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/editing/selection/document-mutation.html
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/editing/selection/select_all/select_all_details_crash.html
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/editing/selection/select_all/select_all_iframe_crash.html
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/editing/selection/selection_remove_children.html
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/editing/style/justify-left-crash.html
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/editing/undo/redo-selection-modify-crash.html
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/fast/dom/delete-contents.html
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/fast/dom/shadow/selection-in-nested-shadow.html
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/fast/dynamic/move-node-with-selection.html
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/fast/events/drag_and_drop_into_removed_on_focus.html
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/images/element-gcd-while-generating-alt-content-expected.txt
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/platform/mac/fast/css/first-letter-rtc-crash-expected.txt
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/platform/win/fast/css/first-letter-rtc-crash-expected.txt
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/LayoutTests/svg/foreignObject/viewport-foreignobject-crash-expected.html
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/Source/core/editing/FrameCaret.cpp
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/Source/core/editing/FrameCaret.h
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/Source/core/editing/FrameSelection.cpp
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/Source/core/editing/FrameSelection.h
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/Source/core/editing/FrameSelectionTest.cpp
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/Source/core/editing/SelectionEditor.cpp
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/Source/core/editing/SelectionEditor.h
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/Source/core/editing/VisibleSelection.cpp
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/Source/core/frame/FrameView.cpp
[modify] https://crrev.com/8f2a1baf12aa71d59d72e24583983b8a6b78340a/third_party/WebKit/Source/core/page/FocusController.cpp

Project Member

Comment 14 by bugdroid1@chromium.org, Feb 14 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/d892f9592860691ae9a782c12260c94ed6bd1a63

commit d892f9592860691ae9a782c12260c94ed6bd1a63
Author: yosin <yosin@chromium.org>
Date: Tue Feb 14 15:56:00 2017

Make FrameSelection to hold non-canonicalized DOM positions

This patch makes |FrameSelection| to hold non-canonicalized DOM positions in
|SelectionEditor| to align Selection API specification[1] for improving
interoperatbility[2].

Before this patch we holds selection as |VisibleSelection| as canonicalized
DOM positions. This behavior is not align with Selection API specification[1]
then the most complained issue of Blink from editing-tf@w3c.

The heart of this patch is holding selection as |SelectionInDOMTree| and
compute |VisibleSelection| on-demand with cache of computed |VisibleSelection|.

|VisibleSelection| cache is invalidate each DOM tree change and style change
since canonicalization referes CSS style properties, e.g display, visibility,
-webkit-user-modify, etc, and layout dimension.

|SelectionEditor| utilizes |SynchronousMutationObserver| to relocate
|m_selectionInDOMTree| instead of |FrameSelection|. Before this patch
|FrameSelection| relocates |VisibleSelection| with dirty layout tree then
sets |FrameSelection::setSelection()|. To void cyclic reference between
|FrameSelection| and |SelectionEditor|, we could not move relocation part to
|SelectionEditor|.

This patch also updates
|FrameSelection::updatePostionAfterAdoptingTextNodesMerged()| to handle
|PositonAnchorType|.

# Highlight of changes
## FrameCaret
- Compute caret position after "layout clean" rather than each selection change
to align rendering pipeline.

## CharacterData
Changes timing of notifying character data update for ease of relocation of
positions.

## FrameSelection
- Move |m_isHandleVisible| to |SelectionInDOMTree| as follow-up of [5].
- Move selection relocation to |SelectionEditor|; following patch will move
implementations to "SelectionEditor.cpp"

## SelecitonEdtior
- Make it to hold |SelectionInDOMTree| with relocation at DOM mutation.
- Caching |VisibleSelection|

# Brief description of test expectation changes:
## ImeTest.java:
This patch gets rid of redundant selection change event from
 - |testImePaste|,
 - |testContentEditableEvents_DeleteSurroundingText|
 - |testInputTextEvents_DeleteSurroundingText|

## LayoutTests
Before this patch, Blink uses |VisibleSelection| when it sets even if style and
layout changed. This is wrong and unexpected behavior since positions in
|VisibleSelection| can no longer be canonicalized positions. This patch changes
this behavior to return "sane" canonicalized positions with clean style and
layout tree.

This patch is the result of many attempts. Previous changes can be found in
[3][4].

[1] https://www.w3.org/TR/selection-api/ W3C Selection API
[2] https://goo.gl/9v1zOK Improving Interoperatbility of Selection
[3] http://crrev.com/1958093002
[4] http://crrev.com/2637013002
[5] http://crrev.com/2651803007 Added isHandleVisible to |SelectionTemplate|

BUG= 139552 ,  603684 ,  605499 ,  606499 ,  625533 ,  644648 ,  679991 
TEST=See changes in this patch
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2

Review-Url: https://codereview.chromium.org/2680943004
Cr-Original-Original-Commit-Position: refs/heads/master@{#449928}
Committed: https://chromium.googlesource.com/chromium/src/+/157413286770a7ac5a24c446a30c08f749738276
Review-Url: https://codereview.chromium.org/2680943004
Cr-Original-Commit-Position: refs/heads/master@{#450280}
Committed: https://chromium.googlesource.com/chromium/src/+/17c84b2b6519c821dc319e79f2a7a4508508e20f
Review-Url: https://codereview.chromium.org/2680943004
Cr-Commit-Position: refs/heads/master@{#450370}

[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/content/public/android/javatests/src/org/chromium/content/browser/input/ImeTest.java
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/TestExpectations
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/editing/deleting/delete-br-001-expected.txt
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/editing/deleting/delete-br-001.html
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/editing/deleting/delete-character-003-expected.txt
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/editing/deleting/delete-character-003.html
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/editing/execCommand/crash-indenting-list-item.html
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/editing/execCommand/crash-inserting-list.html
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/editing/execCommand/format-block-multiple-paragraphs-in-pre.html
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/editing/execCommand/remove_format_and_extract_contents.html
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/editing/selection/character-data-mutation.html
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/editing/selection/document-mutation.html
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/editing/selection/select_all/select_all_details_crash.html
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/editing/selection/select_all/select_all_iframe_crash.html
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/editing/selection/selection_remove_children.html
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/editing/style/justify-left-crash.html
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/editing/undo/redo-selection-modify-crash.html
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/external/wpt/selection/collapse-00-expected.txt
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/external/wpt/selection/collapse-30-expected.txt
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/external/wpt/selection/collapseToStartEnd-expected.txt
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/fast/dom/delete-contents.html
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/fast/dom/shadow/selection-in-nested-shadow.html
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/fast/dynamic/move-node-with-selection.html
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/fast/events/drag_and_drop_into_removed_on_focus.html
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/images/element-gcd-while-generating-alt-content-expected.txt
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/platform/mac/fast/css/first-letter-rtc-crash-expected.txt
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/platform/win/fast/css/first-letter-rtc-crash-expected.txt
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/LayoutTests/svg/foreignObject/viewport-foreignobject-crash-expected.html
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/Source/core/editing/FrameCaret.cpp
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/Source/core/editing/FrameCaret.h
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/Source/core/editing/FrameSelection.cpp
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/Source/core/editing/FrameSelection.h
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/Source/core/editing/FrameSelectionTest.cpp
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/Source/core/editing/SelectionEditor.cpp
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/Source/core/editing/SelectionEditor.h
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/Source/core/editing/VisibleSelection.cpp
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/Source/core/frame/FrameView.cpp
[modify] https://crrev.com/d892f9592860691ae9a782c12260c94ed6bd1a63/third_party/WebKit/Source/core/page/FocusController.cpp

►

Issue 644648 link

Issue metadata

Crash in blink::Node::containsIncludingHostElements

Issue description

Comment 1 by ashej...@chromium.org, Sep 7 2016

Comment 1 Deleted

Comment 2 by manoranj...@chromium.org, Sep 21 2016

Comment 2 Deleted

Comment 3 by tkent@chromium.org, Sep 27 2016

Comment 3 Deleted

Comment 4 by yosin@chromium.org, Sep 27 2016

Comment 4 Deleted

Comment 5 by tkent@chromium.org, Oct 12 2016

Comment 5 Deleted

Comment 6 by bugdroid1@chromium.org, Oct 13 2016

Comment 6 Deleted

Comment 7 by sheriffbot@chromium.org, Nov 22 2016

Comment 7 Deleted

Comment 8 by yosin@chromium.org, Nov 28 2016

Comment 8 Deleted

Comment 9 by ClusterFuzz, Dec 28 2016

Comment 9 Deleted

Comment 10 by bugdroid1@chromium.org, Feb 13 2017

Comment 10 Deleted

Comment 11 by bugdroid1@chromium.org, Feb 13 2017

Comment 11 Deleted

Comment 12 by bugdroid1@chromium.org, Feb 14 2017

Comment 12 Deleted

Comment 13 by bugdroid1@chromium.org, Feb 14 2017

Comment 13 Deleted

Comment 14 by bugdroid1@chromium.org, Feb 14 2017

Comment 14 Deleted

Sign in to add a comment