Title: [171383] trunk
- Revision
- 171383
- Author
- mmaxfi...@apple.com
- Date
- 2014-07-22 19:19:55 -0700 (Tue, 22 Jul 2014)
Log Message
Copying and pasting trivial H2 content causes a crash in firstPositionInNode
https://bugs.webkit.org/show_bug.cgi?id=134897
Reviewed by Ryosuke Niwa.
Source/WebCore:
ReplaceSelectionCommand::makeInsertedContentRoundTrippableWithHTMLTreeBuilder() attempts
to move pasted headings out of existed headings, with out regard to if the existing
heading is the contenteditable root.
Test: editing/pasteboard/heading-crash.html
* editing/ReplaceSelectionCommand.cpp:
(WebCore::ReplaceSelectionCommand::makeInsertedContentRoundTrippableWithHTMLTreeBuilder):
LayoutTests:
Copy and paste text from one heading to another. Make sure there is no crash.
* editing/pasteboard/heading-crash-expected.txt: Added.
* editing/pasteboard/heading-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (171382 => 171383)
--- trunk/LayoutTests/ChangeLog 2014-07-23 02:19:26 UTC (rev 171382)
+++ trunk/LayoutTests/ChangeLog 2014-07-23 02:19:55 UTC (rev 171383)
@@ -1,3 +1,15 @@
+2014-07-16 Myles C. Maxfield <mmaxfi...@apple.com>
+
+ Copying and pasting trivial H2 content causes a crash in firstPositionInNode
+ https://bugs.webkit.org/show_bug.cgi?id=134897
+
+ Reviewed by Ryosuke Niwa.
+
+ Copy and paste text from one heading to another. Make sure there is no crash.
+
+ * editing/pasteboard/heading-crash-expected.txt: Added.
+ * editing/pasteboard/heading-crash.html: Added.
+
2014-07-22 Filip Pizlo <fpi...@apple.com>
Merge r169148, r169185, r169188, r169578, r169582, r169584, r169588, r169753 from ftlopt.
Added: trunk/LayoutTests/editing/pasteboard/heading-crash-expected.txt (0 => 171383)
--- trunk/LayoutTests/editing/pasteboard/heading-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/editing/pasteboard/heading-crash-expected.txt 2014-07-23 02:19:55 UTC (rev 171383)
@@ -0,0 +1,6 @@
+The following test does a copy and a paste from one heading to another heading. The test is successful if there is no crash.
+
+Destination should say Copy This Text:
+| <span>
+| id="source"
+| "Copy This Text<#selection-caret>"
Added: trunk/LayoutTests/editing/pasteboard/heading-crash.html (0 => 171383)
--- trunk/LayoutTests/editing/pasteboard/heading-crash.html (rev 0)
+++ trunk/LayoutTests/editing/pasteboard/heading-crash.html 2014-07-23 02:19:55 UTC (rev 171383)
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+<script src=""
+<script src=""
+<h2 id="source" contenteditable="true">Copy This Text</h2>
+<h2 id="destination" contenteditable="true">Paste Here</h2>
+<script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+
+ var source = document.getElementById("source");
+ var destination = document.getElementById("destination");
+
+ source.focus();
+ selectAllCommand();
+ copyCommand();
+ destination.focus();
+ selectAllCommand();
+ pasteCommand();
+
+ Markup.description("The following test does a copy and a paste from one heading to another heading. The test is successful if there is no crash.");
+ Markup.dump(destination, 'Destination should say Copy This Text');
+</script>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (171382 => 171383)
--- trunk/Source/WebCore/ChangeLog 2014-07-23 02:19:26 UTC (rev 171382)
+++ trunk/Source/WebCore/ChangeLog 2014-07-23 02:19:55 UTC (rev 171383)
@@ -1,3 +1,19 @@
+2014-07-16 Myles C. Maxfield <mmaxfi...@apple.com>
+
+ Copying and pasting trivial H2 content causes a crash in firstPositionInNode
+ https://bugs.webkit.org/show_bug.cgi?id=134897
+
+ Reviewed by Ryosuke Niwa.
+
+ ReplaceSelectionCommand::makeInsertedContentRoundTrippableWithHTMLTreeBuilder() attempts
+ to move pasted headings out of existed headings, with out regard to if the existing
+ heading is the contenteditable root.
+
+ Test: editing/pasteboard/heading-crash.html
+
+ * editing/ReplaceSelectionCommand.cpp:
+ (WebCore::ReplaceSelectionCommand::makeInsertedContentRoundTrippableWithHTMLTreeBuilder):
+
2014-07-22 Ryuan Choi <ryuan.c...@samsung.com>
Remove dead APIs from TiledBackingStore
Modified: trunk/Source/WebCore/editing/ReplaceSelectionCommand.cpp (171382 => 171383)
--- trunk/Source/WebCore/editing/ReplaceSelectionCommand.cpp 2014-07-23 02:19:26 UTC (rev 171382)
+++ trunk/Source/WebCore/editing/ReplaceSelectionCommand.cpp 2014-07-23 02:19:55 UTC (rev 171383)
@@ -619,7 +619,7 @@
return elements.get().contains(name);
}
-void ReplaceSelectionCommand::makeInsertedContentRoundTrippableWithHTMLTreeBuilder(const InsertedNodes& insertedNodes)
+void ReplaceSelectionCommand::makeInsertedContentRoundTrippableWithHTMLTreeBuilder(InsertedNodes& insertedNodes)
{
RefPtr<Node> pastEndNode = insertedNodes.pastLastLeaf();
RefPtr<Node> next;
@@ -638,8 +638,15 @@
}
if (isHeaderElement(node.get())) {
- if (auto* headerElement = highestEnclosingNodeOfType(positionInParentBeforeNode(node.get()), isHeaderElement))
- moveNodeOutOfAncestor(node, headerElement);
+ auto* headerElement = highestEnclosingNodeOfType(positionInParentBeforeNode(node.get()), isHeaderElement);
+ if (headerElement) {
+ if (headerElement->parentNode() && headerElement->parentNode()->isContentRichlyEditable())
+ moveNodeOutOfAncestor(node, headerElement);
+ else {
+ HTMLElement* newSpanElement = replaceElementWithSpanPreservingChildrenAndAttributes(toHTMLElement(node.get()));
+ insertedNodes.didReplaceNode(node.get(), newSpanElement);
+ }
+ }
}
}
}
Modified: trunk/Source/WebCore/editing/ReplaceSelectionCommand.h (171382 => 171383)
--- trunk/Source/WebCore/editing/ReplaceSelectionCommand.h 2014-07-23 02:19:26 UTC (rev 171382)
+++ trunk/Source/WebCore/editing/ReplaceSelectionCommand.h 2014-07-23 02:19:55 UTC (rev 171383)
@@ -89,7 +89,7 @@
void removeUnrenderedTextNodesAtEnds(InsertedNodes&);
void removeRedundantStylesAndKeepStyleSpanInline(InsertedNodes&);
- void makeInsertedContentRoundTrippableWithHTMLTreeBuilder(const InsertedNodes&);
+ void makeInsertedContentRoundTrippableWithHTMLTreeBuilder(InsertedNodes&);
void moveNodeOutOfAncestor(PassRefPtr<Node>, PassRefPtr<Node> ancestor);
void handleStyleSpans(InsertedNodes&);
void handlePasteAsQuotationNode();
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
