CANCELLED Non-laid-out node should not be considered as user-select:contain

third_party/WebKit/Source/core/editing/VisibleUnitsTest.cpp

Index: third_party/WebKit/Source/core/editing/VisibleUnitsTest.cpp
diff --git a/third_party/WebKit/Source/core/editing/VisibleUnitsTest.cpp b/third_party/WebKit/Source/core/editing/VisibleUnitsTest.cpp
index eef817703aad94da2366eb80bb9ba0f3301ebe54..f1c28a5b797070a55922a09a91e4f14a767d2ace 100644
--- a/third_party/WebKit/Source/core/editing/VisibleUnitsTest.cpp
+++ b/third_party/WebKit/Source/core/editing/VisibleUnitsTest.cpp
@@ -2037,4 +2037,14 @@ TEST_F(VisibleUnitsTest,
   EXPECT_EQ(Position(text, 2), start);
 }
 
+// Regression test for crbug.com/702756
+TEST_F(VisibleUnitsTest, canonicalizeSelectOutOfFlatTree) {
+  setBodyContent("<div id=host><select></select></div>");
+  setShadowContent("foo", "host");
+
+  Element* select = document().querySelector("select");
+  EXPECT_EQ(PositionInFlatTree(),
+            canonicalPositionOf(PositionInFlatTree::afterNode(select)));

[yoichio, 2017/03/21 06:48:43]

Getting an node which is after of the node that doesn't exist in  
flat tree doesn't make sense.
Could you assert it in POsitionInFlatTree constructor?
yosin@, do you have any thoughts?

[yosin_UTC9, 2017/03/21 08:48:51]

Agree, we should not accept position not in flat tree.

It seems we can do this check in |canBeAnchorNode<EditingInFlatTreeeStrateg>().

bool canBeAnchorNode<EditingInFlatTreeeStrateg>(const Node& node) {
  DCHECK(!node.needsDistributionRecalc());
  if (!canBeAnchorNode<EditingStrateg>(node))
    return false;
  if (!node.canParticipateInFlatTree())
   return false;
  if (!node.isConnected()) - disconnected node can't be in flat tree
    return false; // How about shadow host in document fragment?
  traverse flat tree parent until null or document. Return true if we reach
document otherwise false.
}

In this test case, SELECT is descendant of shadow host, but not in flat tree.

BTW, who constructor PositionInFlatTree::afterNode(SELECT)?

[Xiaocheng, 2017/03/21 20:27:48]

It's found when trying to remove layout update from Editor::*appliedEditing.
editing/undo/redo_correct_selection.html hits this DCHECK.

HTML: <div contenteditable>foo</div><option><select></select></option>

Editor::reappliedEditing has ending selection S=#text"foo"@0,
E=SELECT@AfterAnchor, which is a valid SelectionInDOMTree

Currently, Editor::reappliedEditing canonicalizes this selection into ^foo|
before passing it to FrameSelection::setSelection.

However, if we pass the uncanonicalized selection directly to
FrameSelection::setSelection, it crashes in the later canonicalization, where it
tries to canonicalize SELECT@AfterAnchor in the flat tree for computing a
VSInFlatTree.

[yosin_UTC9, 2017/03/22 03:19:28]

Yes, this is valid for SelectionInDOMTree.
But, not valid for VisibleSeleciton or VisiblePosition. It should Positon("foo",
3).
OPTION, which is shadow host, should be skipped by canonicalization.
Position::afterNode(SELECT) can't be in Flat Tree, since it isn't distributed in
flat tree.

Anyway, it seems we should change canonicalization to avoid DOM positions in
shadow host.

+}
+
 }  // namespace blink