From 6ee91c4189ab525de88e8be9f2d1597d47a9f0e7 Mon Sep 17 00:00:00 2001 From: Tim Ledbetter Date: Mon, 30 Jun 2025 10:40:29 +0100 Subject: [PATCH] LibWeb: Use correct previous word location when moving selection offset Previously, this incorrect offset could cause a crash when moving the selection to the previous word. --- Libraries/LibWeb/Selection/Selection.cpp | 2 +- ...modify-per-word-in-table-header-group.html | 27 +++++++++++++++++++ 2 files changed, 28 insertions(+), 1 deletion(-) create mode 100644 Tests/LibWeb/Crash/wpt-import/selection/crashtests/selection-modify-per-word-in-table-header-group.html diff --git a/Libraries/LibWeb/Selection/Selection.cpp b/Libraries/LibWeb/Selection/Selection.cpp index 3a4024a67b1..b431444c399 100644 --- a/Libraries/LibWeb/Selection/Selection.cpp +++ b/Libraries/LibWeb/Selection/Selection.cpp @@ -629,7 +629,7 @@ void Selection::move_offset_to_previous_word(bool collapse_selection) while (true) { auto focus_offset = this->focus_offset(); if (auto offset = text_node.word_segmenter().previous_boundary(focus_offset); offset.has_value()) { - auto word = text_node.data().code_points().substring_view(focus_offset, focus_offset - *offset); + auto word = text_node.data().code_points().unicode_substring_view(*offset, focus_offset - *offset); if (collapse_selection) { MUST(collapse(anchor_node, *offset)); m_document->reset_cursor_blink_cycle(); diff --git a/Tests/LibWeb/Crash/wpt-import/selection/crashtests/selection-modify-per-word-in-table-header-group.html b/Tests/LibWeb/Crash/wpt-import/selection/crashtests/selection-modify-per-word-in-table-header-group.html new file mode 100644 index 00000000000..66a57381eda --- /dev/null +++ b/Tests/LibWeb/Crash/wpt-import/selection/crashtests/selection-modify-per-word-in-table-header-group.html @@ -0,0 +1,27 @@ + + + + + + + + + +1 +
+ + + +