4d868d7d82
A Range boundary can point after a non-text container's final child. Range::getClientRects() treated that offset as a child index and bound a reference to null before walking the selected nodes. Start at the node after the container in that case, matching boundary handling used by selection painting. Add a crash test for a collapsed range at the end of an element.
3 lines
43 B
Text
3 lines
43 B
Text
[object DOMRectList]
|
|
[object DOMRect]
|
|
PASS
|