CANCELLED Non-laid-out node should not be considered as user-select:contain

third_party/WebKit/Source/core/editing/VisibleUnitsTest.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/editing/VisibleUnits.h"
 
 #include <ostream>  // NOLINT
 #include "bindings/core/v8/V8BindingForTesting.h"
 #include "core/dom/Text.h"
 #include "core/editing/EditingTestBase.h"
@@ skipping 2019 matching lines @@
 TEST_F(VisibleUnitsTest,
        canonicalizationWithCollapsedSpaceAndIsolatedCombiningCharacter) {
   setBodyContent("<p>  &#x20E3;</p>");  // Leading space is necessary
 
   Node* paragraph = document().querySelector("p");
   Node* text = paragraph->firstChild();
   Position start = canonicalPositionOf(Position::beforeNode(paragraph));
   EXPECT_EQ(Position(text, 2), start);
 }
 
+// Regression test for crbug.com/702756
+TEST_F(VisibleUnitsTest, canonicalizeSelectOutOfFlatTree) {
+  setBodyContent("<div id=host><select></select></div>");
+  setShadowContent("foo", "host");
+
+  Element* select = document().querySelector("select");
+  EXPECT_EQ(PositionInFlatTree(),
+            canonicalPositionOf(PositionInFlatTree::afterNode(select)));

[yoichio, 2017/03/21 06:48:43]

Getting an node which is after of the node that doesn't exist in  
flat tree doesn't make sense.
Could you assert it in POsitionInFlatTree constructor?
yosin@, do you have any thoughts?

[yosin_UTC9, 2017/03/21 08:48:51]

Agree, we should not accept position not in flat tree.

It seems we can do this check in |canBeAnchorNode<EditingInFlatTreeeStrateg>().

bool canBeAnchorNode<EditingInFlatTreeeStrateg>(const Node& node) {
  DCHECK(!node.needsDistributionRecalc());
  if (!canBeAnchorNode<EditingStrateg>(node))
    return false;
  if (!node.canParticipateInFlatTree())
   return false;
  if (!node.isConnected()) - disconnected node can't be in flat tree
    return false; // How about shadow host in document fragment?
  traverse flat tree parent until null or document. Return true if we reach
document otherwise false.
}

In this test case, SELECT is descendant of shadow host, but not in flat tree.

BTW, who constructor PositionInFlatTree::afterNode(SELECT)?

[Xiaocheng, 2017/03/21 20:27:48]

It's found when trying to remove layout update from Editor::*appliedEditing.
editing/undo/redo_correct_selection.html hits this DCHECK.

HTML: <div contenteditable>foo</div><option><select></select></option>

Editor::reappliedEditing has ending selection S=#text"foo"@0,
E=SELECT@AfterAnchor, which is a valid SelectionInDOMTree

Currently, Editor::reappliedEditing canonicalizes this selection into ^foo|
before passing it to FrameSelection::setSelection.

However, if we pass the uncanonicalized selection directly to
FrameSelection::setSelection, it crashes in the later canonicalization, where it
tries to canonicalize SELECT@AfterAnchor in the flat tree for computing a
VSInFlatTree.

[yosin_UTC9, 2017/03/22 03:19:28]

Yes, this is valid for SelectionInDOMTree.
But, not valid for VisibleSeleciton or VisiblePosition. It should Positon("foo",
3).
OPTION, which is shadow host, should be skipped by canonicalization.
Position::afterNode(SELECT) can't be in Flat Tree, since it isn't distributed in
flat tree.

Anyway, it seems we should change canonicalization to avoid DOM positions in
shadow host.

+}
+
 }  // namespace blink