http://mxr.mozilla.org/mozilla-central/source/editor/libeditor/base/IMETextTxn.cpp#235 > 235 // NOTE: If the caret position is larger than max length of the editor > 236 // content, this may fail. > 237 rv = selection->Collapse(mElement, mOffset + textRange.mStartOffset); > 238 setCaret = setCaret || NS_SUCCEEDED(rv); > 239 NS_ASSERTION(setCaret, "Failed to collapse normal selection"); When <input> has specific maxlength value, all of or a part of composition string may be cut at committed. Then, the caret position may be out of text. Then, it hits this assertion.
Created attachment 8444462 [details] [diff] [review] Patch
Attachment #8444432 - Attachment is obsolete: true
Comment on attachment 8444462 [details] [diff] [review] Patch This patch ensures that caret position and range offsets must be in the range of the actual inserted string. When inserting string is truncated by maxlength attribute, mStringToInsert is truncated by the ranges information which comes from widget are not shrunken by it. Therefore, IMETextTxn needs to check mStringToInsert at setting selection/caret.
Attachment #8444462 - Flags: review?(ehsan)
Status: ASSIGNED → RESOLVED
Last Resolved: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla33
You need to log in before you can comment on or make changes to this bug.