New issue
Advanced search Search tips

Issue 850576 link

Starred by 1 user

Issue metadata

Status: Available
Owner: ----
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Compat



Sign in to add a comment

SelectionAdjuster crahes with nested editable

Reported by borispar...@gmail.com, Jun 7 2018

Issue description

UserAgent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36

Example URL:

Steps to reproduce the problem:
1. Open http://jsfiddle.net/q8szg4mo/
2. Mousedown below the picture
3. Move cursor to the picture

http://jsfiddle.net/q8szg4mo/

What is the expected behavior?
Nothing happens (or selection performs)

What went wrong?
Chrome crashes with "Oops.." error and without any log entries

Does it occur on multiple sites: N/A

Is it a problem with a plugin? N/A 

Did this work before? N/A 

Does this work in other browsers? Yes

Chrome version: 66.0.3359.181  Channel: n/a
OS Version: 8.1 Enterprise
Flash Version:
 
Labels: Needs-Triage-M66
Components: Blink
Labels: Triaged-ET TE-NeedsTriageFromHYD
Unable to reproduce the issue on Win-7 and Win-10 using chrome reported version #66.0.3359.181, latest stable #67.0.3396.79 and latest canary #69.0.3452.0.

Attached a screen cast for reference.

Following are the steps followed to reproduce the issue.
------------
1. Opened http://jsfiddle.net/q8szg4mo/
2. Mousedown below the picture
3. Moveed cursor to the picture
4. Observed that nothing happened.

As the issue seems to be specific to 8.1 Enterprise. Hence, forwarding it to inhouse team for further triaging.

Thanks...!!
850576.mp4
762 KB View Download

Comment 3 Deleted

It looks like JSFiddle updated thir engine, so only `result` windows is crashed. Created the same example on codepen
https://codepen.io/anon/pen/gKLzLb

Recording #2.mp4
356 KB View Download
Components: -Blink Blink>Editing>Selection
Status: Untriaged (was: Unconfirmed)
Summary: Renderer crash after dragging with mouse: blink::Node::UpdateDistributionInternal() (was: Browser crashes in some tricky scenario)
Using #c4 I could repro with 68.0.3440.15, report id: 50a530c8817356a1
Using #c4 I could repro with 67.0.3396.79, report id: 5fe963b488909860

Adding Blink>Editing>Selection component based on the callstack:

blink::Node::UpdateDistributionInternal()
blink::ComparePositions(...)
blink::(anonymous namespace)::ComputeAdjustedSelection<...>(...)
blink::SelectionAdjuster::AdjustSelectionToAvoidCrossingEditingBoundaries(...)
blink::VisibleSelectionTemplate<...>::CreateWithGranularity(...)
blink::CreateVisibleSelection(...)
blink::SelectionController::SetNonDirectionalSelectionIfNeeded(...)
blink::SelectionController::UpdateSelectionForMouseDrag(...)
blink::SelectionController::HandleMouseDraggedEvent(...)
blink::MouseEventManager::HandleMouseDraggedEvent(...)
blink::EventHandler::HandleMouseMoveOrLeaveEvent(...)
blink::EventHandler::HandleMouseMoveOrLeaveEvent(...)
blink::EventHandler::HandleMouseMoveEvent(...)
blink::PageWidgetDelegate::HandleInputEvent(...)
blink::WebViewImpl::HandleInputEvent(...)
content::RenderWidgetInputHandler::HandleInputEvent(...)



Comment 6 by yosin@chromium.org, Jun 13 2018

Cc: ctzsm@chromium.org
Status: Available (was: Untriaged)
Summary: SelectionAdjuster crahes with nested editable (was: Renderer crash after dragging with mouse: blink::Node::UpdateDistributionInternal())
I propose new algorithm https://bit.ly/2kUEFZy

# Selection
base = AfterChildren(BODY) editable
extent = BeforeAnchor(IMG) not editable

# Minmal HTML to reproduce
<body contenteditable="true">
<span contenteditable="false">
<span>Mousedown below the picture and move cursor over the picture</span>
<div>
<img src="https://www.google.com/images/branding/googlelogo/2x/googlelogo_color_120x44dp.png">
</div>
</span>
</body>

Sign in to add a comment