Right clicking nested contenteditable table causes tab crash
Reported by
jhch...@gmail.com,
Apr 23 2018
|
|||||||
Issue descriptionUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.117 Safari/537.36 Steps to reproduce the problem: 1. Visit https://jsfiddle.net/p402fg8p/13/ 2. In the rendered HTML pane in the bottom right, right click one of the table cells 3. May have to repeat #2 several times 4. May have to refresh the page and try again if nothing goes wrong after ~10 right clicks What is the expected behavior? Context menu opens What went wrong? The tab crashes Crashed report ID: 3e7c0b0ff71b4369 How much crashed? Just one tab Is it a problem with a plugin? No Did this work before? N/A Chrome version: 66.0.3359.117 Channel: stable OS Version: OS X 10.13.4 Flash Version: Also occurs on https://codepen.io/anon/pen/jxWQab
,
Apr 26 2018
Able to reproduce the issue on Mac 10.13.3 with stable #66.0.3359.117, Canary #68.0.3409.0 Issue broken in M64 Bisect Info: =========== Good build : 64.0.3261.0, Revision Range -514329 Bad build : 64.0.3262.0, Revision Range -514703 Executed per-revision bisect script for above range, but it given suspected CL(https://chromium-review.googlesource.com/720270) which is related to Android OS only Hence Untriaging this issue and requesting dev team to look into below manual CL: https://chromium.googlesource.com/chromium/src/+log/64.0.3261.0..64.0.3262.0?pretty=fuller&n=10000 and assign it to concern owners. Note : Issue is not seen on Debian Rodete & Windows 10 Thank You...
,
Apr 26 2018
,
Apr 26 2018
Browser received a bad IPC message here: https://chromium.googlesource.com/chromium/src/+/68.0.3409.0/content/browser/frame_host/render_frame_host_impl.cc#2005 if (validated_params.selection_start_offset < 0) { bad_message::ReceivedBadMessage( GetProcess(), bad_message::RFH_NEGATIVE_SELECTION_START_OFFSET); }
,
Apr 26 2018
The issue repros on Mac only, when right-clicking on the right edge of the text in a cell.
Root cause: when right clicking (e.g., at "A1|"), Blink should extend selection to word boundary ("^A1|"), but actually creates selection <td contenteditable>A1^</td><td contenteditable>|B1</td>. Then Blink fails to calculate the selection offsets since the selection base and extent are not in the same editable element.
The issue reproduces on Mac only, due to the Mac-only editing behavior that right-clicking on the edge of a word selects the word. To reproduce on other platforms, open the test case in content_shell with --expose-internals-for-testing flag, and run internals.settings.setEditingBehavior('mac') in the page.
Assign to yosin@ who is working on selection expansion by granularity.
,
May 9 2018
,
May 10 2018
|
|||||||
►
Sign in to add a comment |
|||||||
Comment 1 by jhch...@gmail.com
, Apr 23 2018