Title: [91276] branches/chromium/782
- Revision
- 91276
- Author
- [email protected]
- Date
- 2011-07-19 11:36:01 -0700 (Tue, 19 Jul 2011)
Log Message
Merge 91270
BUG=89678
Review URL: http://codereview.chromium.org/7446011
Modified Paths
Added Paths
Diff
Copied: branches/chromium/782/LayoutTests/editing/pasteboard/replacement-fragment-remove-unrendered-node-crash-expected.txt (from rev 91270, trunk/LayoutTests/editing/pasteboard/replacement-fragment-remove-unrendered-node-crash-expected.txt) (0 => 91276)
--- branches/chromium/782/LayoutTests/editing/pasteboard/replacement-fragment-remove-unrendered-node-crash-expected.txt (rev 0)
+++ branches/chromium/782/LayoutTests/editing/pasteboard/replacement-fragment-remove-unrendered-node-crash-expected.txt 2011-07-19 18:36:01 UTC (rev 91276)
@@ -0,0 +1 @@
+Test passes if it does not crash.
Copied: branches/chromium/782/LayoutTests/editing/pasteboard/replacement-fragment-remove-unrendered-node-crash.html (from rev 91270, trunk/LayoutTests/editing/pasteboard/replacement-fragment-remove-unrendered-node-crash.html) (0 => 91276)
--- branches/chromium/782/LayoutTests/editing/pasteboard/replacement-fragment-remove-unrendered-node-crash.html (rev 0)
+++ branches/chromium/782/LayoutTests/editing/pasteboard/replacement-fragment-remove-unrendered-node-crash.html 2011-07-19 18:36:01 UTC (rev 91276)
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+Test passes if it does not crash.
+<input id="test" contenteditable="true">
+<script src=""
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+var e = document.getElementById("test");
+var s = window.getSelection();
+
+s.setPosition(e, 10500000000);
+insertHTMLCommand("<noscript>baz");
+</script>
+</html>
Modified: branches/chromium/782/Source/WebCore/editing/ReplaceSelectionCommand.cpp (91275 => 91276)
--- branches/chromium/782/Source/WebCore/editing/ReplaceSelectionCommand.cpp 2011-07-19 18:33:49 UTC (rev 91275)
+++ branches/chromium/782/Source/WebCore/editing/ReplaceSelectionCommand.cpp 2011-07-19 18:36:01 UTC (rev 91276)
@@ -292,7 +292,7 @@
void ReplacementFragment::removeUnrenderedNodes(Node* holder)
{
- Vector<Node*> unrendered;
+ Vector<RefPtr<Node> > unrendered;
for (Node* node = holder->firstChild(); node; node = node->traverseNextNode(holder))
if (!isNodeRendered(node) && !isTableStructureNode(node))
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
