RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-25 02:57:42 +00:00
Code Issues Activity Actions

LibWeb: Don't crash on live range offset update during node insertion

Browse source 
When inserting a node into a parent, any live DOM ranges that reference
the parent may need to be updated. The spec does this by increasing or
decreasing the start/end offsets of each live range *before* actually
performing the insertion.

This caused us to crash with a verification failure, since it was
possible to set the range offset to an invalid value (that would go on
to immediately become valid after the insertion was finished).

This patch fixes the issue by adding special badged helpers on Range for
Node to reach into it and increase/decrease the offsets during node
insertion. This skips the offset validity check and actually makes our
code read slightly more like the spec.

Found by Domato :^)
This commit is contained in:
Andreas Kling 2024-03-12 13:08:10 +01:00
parent 43d2c920e0
commit bbb96d65b1
5 changed files with 48 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

14
Tests/LibWeb/Text/input/DOM/update-live-ranges-on-node-insertion.html Normal file
View file

@ -0,0 +1,14 @@
<script src="../include.js"></script>
<script>
test(() => {
const h2 = document.querySelector("h2");
document.getSelection().collapse(h2, 1);
var h3 = document.createElement("h3");
h2.insertBefore(h3, h2.firstChild)
println(document.getSelection().rangeCount);
printElement(document.getSelection().getRangeAt(0).startContainer);
println(document.getSelection().getRangeAt(0).startOffset);
printElement(document.getSelection().getRangeAt(0).endContainer);
println(document.getSelection().getRangeAt(0).endOffset);
});
</script><h2>