Chrome browser ≥ 105 crashed after focus into editor

woody-li commented 1 year ago

Type of report

Bug

Provide detailed reproduction steps (if any)

CodePen: https://codepen.io/Woody-lxf/pen/wvEwoEX

Created a widget named "math", and generate a math SVG image. After set some font style, save the content. Displays the content by setData, then focus into editor, the browser crashed.

Example content data

<p>
 <span style="font-family:Courier New,Courier,monospace;">
   <span style="font-size:10pt;">
     <span tabindex="-1" contenteditable="false" data-cke-widget-wrapper="1" data-cke-filter="off" class="cke_widget_wrapper cke_widget_inline cke_widget_math" data-cke-display-name="span" data-cke-widget-id="1" role="region">
       <span class="cke_widget_element" data-cke-widget-keep-attr="0" data-widget="math">
         <span contenteditable="false">
           <svg xmlns="http://www.w3.org/2000/svg" width="15.0625px" height="12.875px" viewBox="0 -583 778 665" xmlns:xlink="http://www.w3.org/1999/xlink">
             <g stroke="currentColor" fill="currentColor" stroke-width="0" transform="scale(1,-1)">
               <path d="M56 347Q56 360 70 367H707Q722 359 722 347Q722 336 708 328L390 327H72Q56 332 56 347ZM56 153Q56 168 72 173H708Q722 163 722 153Q722 140 707 133H70Q56 140 56 153Z"></path>
             </g>
           </svg>
         </span>
       </span>
     </span>
   </span>
 </span>
</p>

Other details

Browser: Only reproduced at Chrome 105 and above versions.
OS: Windows 10
CKEditor version: 4.20.1

woody-li commented 1 year ago

It seems like crashed at https://github.com/ckeditor/ckeditor4/blob/master/core/editable.js#L635.

The Selection is none, Range isn't a editable element and its offset (start, end) both 0. After comment out it or wrap a setTimeout to it will works well.

// update Others addRange function call maybe cause crash also.

I found a chromium issue, not sure whether it relevant. https://bugs.chromium.org/p/chromium/issues/detail?id=138439

Comandeer commented 1 year ago

I can confirm the issue.

woody-li commented 1 year ago

Confirmed that it's a Chromium issue. https://bugs.chromium.org/p/chromium/issues/detail?id=1384470

ckeditor / ckeditor4