Index: Source/core/dom/Range.cpp |
diff --git a/Source/core/dom/Range.cpp b/Source/core/dom/Range.cpp |
index 6dbb4423e59210e1df4c454a8e19200a668da4f2..37bd906ed437cd8c7d5d8bab759f48453bab4a8e 100644 |
--- a/Source/core/dom/Range.cpp |
+++ b/Source/core/dom/Range.cpp |
@@ -1041,14 +1041,15 @@ void Range::insertNode(PassRefPtr<Node> prpNewNode, ExceptionState& es) |
if (collapsed) |
lastChild = (newNodeType == Node::DOCUMENT_FRAGMENT_NODE) ? newNode->lastChild() : newNode; |
- int startOffset = m_start.offset(); |
container = m_start.container(); |
- container->insertBefore(newNode.release(), container->childNode(startOffset), es); |
+ container->insertBefore(newNode.release(), container->childNode(m_start.offset()), es); |
if (es.hadException()) |
return; |
+ // Note that m_start.offset() may have changed as a result of container->insertBefore, |
+ // when the node we are inserting comes before the range in the same container. |
if (collapsed && numNewChildren) |
- m_end.set(m_start.container(), startOffset + numNewChildren, lastChild.get()); |
+ m_end.set(m_start.container(), m_start.offset() + numNewChildren, lastChild.get()); |
yosin_UTC9
2013/10/03 01:41:19
Does |numNewChildren| keep right value when mutati
|
} |
} |