[Editing] Fix null check for block_flow while creating inline contents

on extending selection backward. When selection is extended backward word-wise and block element is part of the inline item, if the target in |CreateInlineContentsFromBlockFlow| is part of the Shadow tree but the block_flow is anonymous and outside the Shadow tree then the target is never reached and as block_flow being a PseudoNode, makes |first| and |last| as nullptr since the traversal inside the shadow tree doesn't happen for user agent root. Thus we need to re-target the target before we create inline contents from block_flow in this case to avoid the crash and get to the correct target. This CL fixes this by sending the correct target before calling |CreateInlineContentsFromBlockFlow| in |ComputeInlineContentsFromNode|. Bug: 380107555 Change-Id: I40dbb7628ed6dd7ecebd5842ee740c28c7a5037d Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6175802 Commit-Queue: Pranav Modi <[email protected]> Reviewed-by: Kent Tamura <[email protected]> Reviewed-by: Sambamurthy Bandaru <[email protected]> Cr-Commit-Position: refs/heads/main@{#1424395}
web-platform-tests · Feb 25, 2025 · d7fa260 · d7fa260
1 parent 570d512
commit d7fa260
Showing 1 changed file with 27 additions and 0 deletions.
diff --git a/selection/extend-selection-backward-on-input.html b/selection/extend-selection-backward-on-input.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<title>
+  This test crashes if block_flow is a pseudo node and first or last is null
+  while creating inline contents from block flow if there is a block_node in an
+  inline node.
+</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+  function runTest() {
+    test(() => {
+      const div = document.createElement("div");
+      document.body.appendChild(div);
+      const bold = document.createElement("b");
+      document.body.appendChild(bold);
+      const input = document.createElement("input");
+      bold.appendChild(input);
+      input.setAttribute("type", "file");
+      document.execCommand("selectall");
+      const p = document.createElement("p");
+      bold.appendChild(p);
+      window.getSelection().modify("extend", "backward", "word");
+    }, "Should not crash if block node is in an inline node and block_flow is a pseudo node");
+    done();
+  }
+  window.addEventListener("load", runTest, { once: true });
+</script>