LayoutTests/fast/dom/Range/range-extract-contents-after-move-to-another-document-crash.html - Issue 332173003: Update owner document of Range objects if start/end boundary points in different document

Side by Side Diff

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Keyboard Shortcuts

	File
u :	up to issue
j / k :	jump to file after / before current file
J / K :	jump to next file with a comment after / before current file
	Side-by-side diff
i :	toggle intra-line diffs
e :	expand all comments
c :	collapse all comments
s :	toggle showing all comments
n / p :	next / previous diff chunk or comment
N / P :	next / previous comment
<Up> / <Down> :	next / previous line

	Issue
u :	up to list of issues
j / k :	jump to patch after / before current patch
o / <Enter> :	open current patch in side-by-side view
i :	open current patch in unified diff view

	Issue List
j / k :	jump to issue after / before current issue
o / <Enter> :	open current issue

Side by Side Diff: LayoutTests/fast/dom/Range/range-extract-contents-after-move-to-another-document-crash.html

Issue 332173003: Update owner document of Range objects if start/end boundary points in different document (Closed) Base URL: https://chromium.googlesource.com/chromium/blink.git@master

Patch Set: 2014-06-17T06:07:48 Created 6 years, 6 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch

OLD	NEW
(Empty)
	1 <!DOCTYPE html>

	2 <html>

	3 <head>

	4 <script>

	5 if (window.testRunner)

	6 testRunner.dumpAsText();

	7

	8 onload = function() {

	9 var target = document.getElementById('target');

	10 var child1 = document.getElementById('c1');

	11 var child2 = document.getElementById('c2');

	12 var child3 = document.getElementById('c3');

	13 document.body.removeChild(target);

	14 var range = document.createRange();

	15 range.selectNode(child2)

	16 target.removeChild(child3);
	Yuta Kitamura 2014/06/18 07:48:27 Is this line necessary? Is this line necessary? yosin_UTC9 2014/06/18 08:55:40 Yes, this \|target.removeChild\| invalidates offset Show quoted text On 2014/06/18 07:48:27, Yuta Kitamura wrote: > Is this line necessary? Yes, this \|target.removeChild\| invalidates offset cache in boundary points. This cache is fulfilled at \|range.extractContents\|. When we remove this statement, offset cache set by \|target.selectNode\| is used at \|ragne.extractContents\|.
	17 var anotherDocument = document.implementation.createDocument('', null);

	18 anotherDocument.appendChild(target);

	19 target.appendChild(child1);
	Yuta Kitamura 2014/06/18 07:48:27 Is this line necessary? Is this line necessary? yosin_UTC9 2014/06/18 08:55:40 Yes, this \|target.appendChild()\| invokes Range bou Show quoted text On 2014/06/18 07:48:27, Yuta Kitamura wrote: > Is this line necessary? Yes, this \|target.appendChild()\| invokes Range boundary points update for Range objects in owner document of \|target\|, which is \|anotherDocument\|. So, this statement assumes that owner document of Range and owner document of boundary points is same.
	20

	21 range.extractContents();

	22 document.body.textContent = 'PASS if Blink doesn\'t crash.';

	23 };

	24 </script>

	25 </head>

	26 <body>

	27 <span id="target">

	28 <b id="c1"></b><div id="c2"></div><input id="c3">

	29 </span>

	30 </body>

	31 </html>

OLD	NEW