Title: [91270] trunk
- Revision
- 91270
- Author
- [email protected]
- Date
- 2011-07-19 10:39:03 -0700 (Tue, 19 Jul 2011)
Log Message
Source/WebCore: Crash when removing unrenderered nodes in replacement fragment.
https://bugs.webkit.org/show_bug.cgi?id=64801
Reviewed by Ryosuke Niwa.
Test: editing/pasteboard/replacement-fragment-remove-unrendered-node-crash.html
* editing/ReplaceSelectionCommand.cpp:
(WebCore::ReplacementFragment::removeUnrenderedNodes):
LayoutTests: Tests that we do not crash when removing unrendering nodes
in a replacement fragment.
https://bugs.webkit.org/show_bug.cgi?id=64801
Reviewed by Ryosuke Niwa.
* editing/pasteboard/replacement-fragment-remove-unrendered-node-crash-expected.txt: Added.
* editing/pasteboard/replacement-fragment-remove-unrendered-node-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (91269 => 91270)
--- trunk/LayoutTests/ChangeLog 2011-07-19 17:26:12 UTC (rev 91269)
+++ trunk/LayoutTests/ChangeLog 2011-07-19 17:39:03 UTC (rev 91270)
@@ -1,3 +1,14 @@
+2011-07-19 Abhishek Arya <[email protected]>
+
+ Tests that we do not crash when removing unrendering nodes
+ in a replacement fragment.
+ https://bugs.webkit.org/show_bug.cgi?id=64801
+
+ Reviewed by Ryosuke Niwa.
+
+ * editing/pasteboard/replacement-fragment-remove-unrendered-node-crash-expected.txt: Added.
+ * editing/pasteboard/replacement-fragment-remove-unrendered-node-crash.html: Added.
+
2011-07-19 Rob Buis <[email protected]>
https://bugs.webkit.org/show_bug.cgi?id=64673
Added: trunk/LayoutTests/editing/pasteboard/replacement-fragment-remove-unrendered-node-crash-expected.txt (0 => 91270)
--- trunk/LayoutTests/editing/pasteboard/replacement-fragment-remove-unrendered-node-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/editing/pasteboard/replacement-fragment-remove-unrendered-node-crash-expected.txt 2011-07-19 17:39:03 UTC (rev 91270)
@@ -0,0 +1 @@
+Test passes if it does not crash.
Added: trunk/LayoutTests/editing/pasteboard/replacement-fragment-remove-unrendered-node-crash.html (0 => 91270)
--- trunk/LayoutTests/editing/pasteboard/replacement-fragment-remove-unrendered-node-crash.html (rev 0)
+++ trunk/LayoutTests/editing/pasteboard/replacement-fragment-remove-unrendered-node-crash.html 2011-07-19 17:39:03 UTC (rev 91270)
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+Test passes if it does not crash.
+<input id="test" contenteditable="true">
+<script src=""
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+var e = document.getElementById("test");
+var s = window.getSelection();
+
+s.setPosition(e, 10500000000);
+insertHTMLCommand("<noscript>baz");
+</script>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (91269 => 91270)
--- trunk/Source/WebCore/ChangeLog 2011-07-19 17:26:12 UTC (rev 91269)
+++ trunk/Source/WebCore/ChangeLog 2011-07-19 17:39:03 UTC (rev 91270)
@@ -1,3 +1,15 @@
+2011-07-19 Abhishek Arya <[email protected]>
+
+ Crash when removing unrenderered nodes in replacement fragment.
+ https://bugs.webkit.org/show_bug.cgi?id=64801
+
+ Reviewed by Ryosuke Niwa.
+
+ Test: editing/pasteboard/replacement-fragment-remove-unrendered-node-crash.html
+
+ * editing/ReplaceSelectionCommand.cpp:
+ (WebCore::ReplacementFragment::removeUnrenderedNodes):
+
2011-07-19 Rob Buis <[email protected]>
https://bugs.webkit.org/show_bug.cgi?id=64673
Modified: trunk/Source/WebCore/editing/ReplaceSelectionCommand.cpp (91269 => 91270)
--- trunk/Source/WebCore/editing/ReplaceSelectionCommand.cpp 2011-07-19 17:26:12 UTC (rev 91269)
+++ trunk/Source/WebCore/editing/ReplaceSelectionCommand.cpp 2011-07-19 17:39:03 UTC (rev 91270)
@@ -292,7 +292,7 @@
void ReplacementFragment::removeUnrenderedNodes(Node* holder)
{
- Vector<Node*> unrendered;
+ Vector<RefPtr<Node> > unrendered;
for (Node* node = holder->firstChild(); node; node = node->traverseNextNode(holder))
if (!isNodeRendered(node) && !isTableStructureNode(node))
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
