Diff
Modified: branches/safari-534.51-branch/LayoutTests/ChangeLog (91425 => 91426)
--- branches/safari-534.51-branch/LayoutTests/ChangeLog 2011-07-20 23:59:39 UTC (rev 91425)
+++ branches/safari-534.51-branch/LayoutTests/ChangeLog 2011-07-21 00:13:39 UTC (rev 91426)
@@ -1,5 +1,19 @@
2011-07-20 Lucas Forschler <[email protected]>
+ Merged 88456.
+
+ 2011-06-08 Abhishek Arya <[email protected]>
+
+ Reviewed by Ryosuke Niwa.
+
+ Tests that setting selection on a text control does not result in crash.
+ https://bugs.webkit.org/show_bug.cgi?id=62329
+
+ * fast/forms/text-control-selection-crash-expected.txt: Added.
+ * fast/forms/text-control-selection-crash.html: Added.
+
+2011-07-20 Lucas Forschler <[email protected]>
+
Merged 88137.
2011-06-05 Kent Tamura <[email protected]>
Copied: branches/safari-534.51-branch/LayoutTests/fast/forms/text-control-selection-crash-expected.txt (from rev 88456, trunk/LayoutTests/fast/forms/text-control-selection-crash-expected.txt) (0 => 91426)
--- branches/safari-534.51-branch/LayoutTests/fast/forms/text-control-selection-crash-expected.txt (rev 0)
+++ branches/safari-534.51-branch/LayoutTests/fast/forms/text-control-selection-crash-expected.txt 2011-07-21 00:13:39 UTC (rev 91426)
@@ -0,0 +1 @@
+Test passes if it does not crash.
Copied: branches/safari-534.51-branch/LayoutTests/fast/forms/text-control-selection-crash.html (from rev 88456, trunk/LayoutTests/fast/forms/text-control-selection-crash.html) (0 => 91426)
--- branches/safari-534.51-branch/LayoutTests/fast/forms/text-control-selection-crash.html (rev 0)
+++ branches/safari-534.51-branch/LayoutTests/fast/forms/text-control-selection-crash.html 2011-07-21 00:13:39 UTC (rev 91426)
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+Test passes if it does not crash.
+<textarea id="A"></textarea>
+<textarea id="B"></textarea>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+A.selectionStart = 0;
+B.style.display = "none";
+B.selectionStart = 0;
+</script>
+</html>
Modified: branches/safari-534.51-branch/Source/WebCore/ChangeLog (91425 => 91426)
--- branches/safari-534.51-branch/Source/WebCore/ChangeLog 2011-07-20 23:59:39 UTC (rev 91425)
+++ branches/safari-534.51-branch/Source/WebCore/ChangeLog 2011-07-21 00:13:39 UTC (rev 91426)
@@ -1,5 +1,31 @@
2011-07-20 Lucas Forschler <[email protected]>
+ Merged 88456.
+
+ 2011-06-08 Abhishek Arya <[email protected]>
+
+ Reviewed by Ryosuke Niwa.
+
+ Make indexForVisiblePosition and isSelectableElement static.
+ https://bugs.webkit.org/show_bug.cgi?id=62329
+
+ This protects us when converting frame->selection->start() or end()
+ to VisiblePosition which blows away the RenderTextControl from
+ underneath (due to layout update).
+
+ Test: fast/forms/text-control-selection-crash.html
+
+ * accessibility/AccessibilityRenderObject.cpp:
+ (WebCore::AccessibilityRenderObject::indexForVisiblePosition):
+ * rendering/RenderTextControl.cpp:
+ (WebCore::RenderTextControl::selectionStart):
+ (WebCore::RenderTextControl::selectionEnd):
+ (WebCore::RenderTextControl::isSelectableElement):
+ (WebCore::RenderTextControl::indexForVisiblePosition):
+ * rendering/RenderTextControl.h:
+
+2011-07-20 Lucas Forschler <[email protected]>
+
Merged 88277.
2011-06-07 Abhishek Arya <[email protected]>
Modified: branches/safari-534.51-branch/Source/WebCore/accessibility/AccessibilityRenderObject.cpp (91425 => 91426)
--- branches/safari-534.51-branch/Source/WebCore/accessibility/AccessibilityRenderObject.cpp 2011-07-20 23:59:39 UTC (rev 91425)
+++ branches/safari-534.51-branch/Source/WebCore/accessibility/AccessibilityRenderObject.cpp 2011-07-21 00:13:39 UTC (rev 91426)
@@ -2477,7 +2477,7 @@
int AccessibilityRenderObject::indexForVisiblePosition(const VisiblePosition& pos) const
{
if (isNativeTextControl())
- return toRenderTextControl(m_renderer)->indexForVisiblePosition(pos);
+ return RenderTextControl::indexForVisiblePosition(toRenderTextControl(m_renderer)->innerTextElement(), pos);
if (!isTextControl())
return 0;
Modified: branches/safari-534.51-branch/Source/WebCore/rendering/RenderTextControl.cpp (91425 => 91426)
--- branches/safari-534.51-branch/Source/WebCore/rendering/RenderTextControl.cpp 2011-07-20 23:59:39 UTC (rev 91425)
+++ branches/safari-534.51-branch/Source/WebCore/rendering/RenderTextControl.cpp 2011-07-21 00:13:39 UTC (rev 91426)
@@ -205,7 +205,12 @@
Frame* frame = this->frame();
if (!frame)
return 0;
- return indexForVisiblePosition(frame->selection()->start());
+
+ HTMLElement* innerText = innerTextElement();
+ // Do not call innerTextElement() in the function arguments as creating a VisiblePosition
+ // from frame->selection->start() can blow us from underneath. Also, function ordering is
+ // usually dependent on the compiler.
+ return RenderTextControl::indexForVisiblePosition(innerText, frame->selection()->start());
}
int RenderTextControl::selectionEnd() const
@@ -213,7 +218,12 @@
Frame* frame = this->frame();
if (!frame)
return 0;
- return indexForVisiblePosition(frame->selection()->end());
+
+ HTMLElement* innerText = innerTextElement();
+ // Do not call innerTextElement() in the function arguments as creating a VisiblePosition
+ // from frame->selection->end() can blow us from underneath. Also, function ordering is
+ // usually dependent on the compiler.
+ return RenderTextControl::indexForVisiblePosition(innerText, frame->selection()->end());
}
bool RenderTextControl::hasVisibleTextArea() const
@@ -256,11 +266,11 @@
frame->selection()->setSelection(newSelection);
}
-bool RenderTextControl::isSelectableElement(Node* node) const
+bool RenderTextControl::isSelectableElement(HTMLElement* m_innerText, Node* node)
{
if (!node || !m_innerText)
return false;
-
+
if (node->rootEditableElement() == m_innerText)
return true;
@@ -334,14 +344,14 @@
return VisiblePosition(Position(endContainer, endOffset, Position::PositionIsOffsetInAnchor), UPSTREAM);
}
-int RenderTextControl::indexForVisiblePosition(const VisiblePosition& pos) const
+int RenderTextControl::indexForVisiblePosition(HTMLElement* innerTextElement, const VisiblePosition& pos)
{
Position indexPosition = pos.deepEquivalent();
- if (!isSelectableElement(indexPosition.deprecatedNode()))
+ if (!RenderTextControl::isSelectableElement(innerTextElement, indexPosition.deprecatedNode()))
return 0;
ExceptionCode ec = 0;
- RefPtr<Range> range = Range::create(document());
- range->setStart(m_innerText.get(), 0, ec);
+ RefPtr<Range> range = Range::create(indexPosition.document());
+ range->setStart(innerTextElement, 0, ec);
ASSERT(!ec);
range->setEnd(indexPosition.deprecatedNode(), indexPosition.deprecatedEditingOffset(), ec);
ASSERT(!ec);
Modified: branches/safari-534.51-branch/Source/WebCore/rendering/RenderTextControl.h (91425 => 91426)
--- branches/safari-534.51-branch/Source/WebCore/rendering/RenderTextControl.h 2011-07-20 23:59:39 UTC (rev 91425)
+++ branches/safari-534.51-branch/Source/WebCore/rendering/RenderTextControl.h 2011-07-21 00:13:39 UTC (rev 91426)
@@ -49,7 +49,7 @@
void selectionChanged(bool userTriggered);
VisiblePosition visiblePositionForIndex(int index) const;
- int indexForVisiblePosition(const VisiblePosition&) const;
+ static int indexForVisiblePosition(HTMLElement*, const VisiblePosition&);
void updatePlaceholderVisibility(bool, bool);
@@ -104,7 +104,7 @@
bool hasVisibleTextArea() const;
friend void setSelectionRange(Node*, int start, int end);
- bool isSelectableElement(Node*) const;
+ static bool isSelectableElement(HTMLElement*, Node*);
virtual int textBlockInsetLeft() const = 0;
virtual int textBlockInsetRight() const = 0;
