Title: [92966] trunk
- Revision
- 92966
- Author
- [email protected]
- Date
- 2011-08-12 09:27:57 -0700 (Fri, 12 Aug 2011)
Log Message
Crash in WebCore::editingIgnoresContent
https://bugs.webkit.org/show_bug.cgi?id=66125
Reviewed by Ryosuke Niwa.
Source/WebCore:
RefPtr a few nodes in case they get blown away in
dispatchEvent calls.
Test: editing/selection/select-start-remove-root-crash.html
* editing/FrameSelection.cpp:
(WebCore::FrameSelection::selectAll):
* editing/ReplaceSelectionCommand.cpp:
(WebCore::ReplacementFragment::ReplacementFragment):
LayoutTests:
Tests that we do not crash when we blow away the root
during the firing of selectstart event in selection.
* editing/selection/select-start-remove-root-crash-expected.txt: Added.
* editing/selection/select-start-remove-root-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (92965 => 92966)
--- trunk/LayoutTests/ChangeLog 2011-08-12 16:26:39 UTC (rev 92965)
+++ trunk/LayoutTests/ChangeLog 2011-08-12 16:27:57 UTC (rev 92966)
@@ -1,3 +1,16 @@
+2011-08-12 Abhishek Arya <[email protected]>
+
+ Crash in WebCore::editingIgnoresContent
+ https://bugs.webkit.org/show_bug.cgi?id=66125
+
+ Reviewed by Ryosuke Niwa.
+
+ Tests that we do not crash when we blow away the root
+ during the firing of selectstart event in selection.
+
+ * editing/selection/select-start-remove-root-crash-expected.txt: Added.
+ * editing/selection/select-start-remove-root-crash.html: Added.
+
2011-08-12 Yury Semikhatsky <[email protected]>
Web Inspector: expand exception properties when wrapping it as object.
Added: trunk/LayoutTests/editing/selection/select-start-remove-root-crash-expected.txt (0 => 92966)
--- trunk/LayoutTests/editing/selection/select-start-remove-root-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/editing/selection/select-start-remove-root-crash-expected.txt 2011-08-12 16:27:57 UTC (rev 92966)
@@ -0,0 +1 @@
+PASS
Added: trunk/LayoutTests/editing/selection/select-start-remove-root-crash.html (0 => 92966)
--- trunk/LayoutTests/editing/selection/select-start-remove-root-crash.html (rev 0)
+++ trunk/LayoutTests/editing/selection/select-start-remove-root-crash.html 2011-08-12 16:27:57 UTC (rev 92966)
@@ -0,0 +1,24 @@
+<html>
+<script>
+if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+}
+
+function runTest()
+{
+ document.write("PASS");
+
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+}
+
+function select()
+{
+ document.execCommand("SelectAll");
+}
+
+window.addEventListener("selectstart", runTest, true);
+window.setInterval(select, 0);
+</script>
+</html>
\ No newline at end of file
Modified: trunk/Source/WebCore/ChangeLog (92965 => 92966)
--- trunk/Source/WebCore/ChangeLog 2011-08-12 16:26:39 UTC (rev 92965)
+++ trunk/Source/WebCore/ChangeLog 2011-08-12 16:27:57 UTC (rev 92966)
@@ -1,3 +1,20 @@
+2011-08-12 Abhishek Arya <[email protected]>
+
+ Crash in WebCore::editingIgnoresContent
+ https://bugs.webkit.org/show_bug.cgi?id=66125
+
+ Reviewed by Ryosuke Niwa.
+
+ RefPtr a few nodes in case they get blown away in
+ dispatchEvent calls.
+
+ Test: editing/selection/select-start-remove-root-crash.html
+
+ * editing/FrameSelection.cpp:
+ (WebCore::FrameSelection::selectAll):
+ * editing/ReplaceSelectionCommand.cpp:
+ (WebCore::ReplacementFragment::ReplacementFragment):
+
2011-08-11 Pavel Podivilov <[email protected]>
Web Inspector: properly update console message count in source frames and resources panel.
Modified: trunk/Source/WebCore/editing/FrameSelection.cpp (92965 => 92966)
--- trunk/Source/WebCore/editing/FrameSelection.cpp 2011-08-12 16:26:39 UTC (rev 92965)
+++ trunk/Source/WebCore/editing/FrameSelection.cpp 2011-08-12 16:27:57 UTC (rev 92966)
@@ -1431,14 +1431,14 @@
}
}
- Node* root = 0;
+ RefPtr<Node> root = 0;
Node* selectStartTarget = 0;
if (isContentEditable()) {
root = highestEditableRoot(m_selection.start());
if (Node* shadowRoot = m_selection.nonBoundaryShadowTreeRootNode())
selectStartTarget = shadowRoot->shadowAncestorNode();
else
- selectStartTarget = root;
+ selectStartTarget = root.get();
} else {
root = m_selection.nonBoundaryShadowTreeRootNode();
if (root)
@@ -1454,7 +1454,7 @@
if (selectStartTarget && !selectStartTarget->dispatchEvent(Event::create(eventNames().selectstartEvent, true, true)))
return;
- VisibleSelection newSelection(VisibleSelection::selectionFromContentsOfNode(root));
+ VisibleSelection newSelection(VisibleSelection::selectionFromContentsOfNode(root.get()));
if (shouldChangeSelection(newSelection))
setSelection(newSelection);
Modified: trunk/Source/WebCore/editing/ReplaceSelectionCommand.cpp (92965 => 92966)
--- trunk/Source/WebCore/editing/ReplaceSelectionCommand.cpp 2011-08-12 16:26:39 UTC (rev 92965)
+++ trunk/Source/WebCore/editing/ReplaceSelectionCommand.cpp 2011-08-12 16:27:57 UTC (rev 92966)
@@ -139,7 +139,7 @@
if (!m_fragment->firstChild())
return;
- Element* editableRoot = selection.rootEditableElement();
+ RefPtr<Element> editableRoot = selection.rootEditableElement();
ASSERT(editableRoot);
if (!editableRoot)
return;
@@ -154,8 +154,8 @@
return;
}
- Node* styleNode = selection.base().deprecatedNode();
- RefPtr<StyledElement> holder = insertFragmentForTestRendering(styleNode);
+ RefPtr<Node> styleNode = selection.base().deprecatedNode();
+ RefPtr<StyledElement> holder = insertFragmentForTestRendering(styleNode.get());
if (!holder) {
removeInterchangeNodes(m_fragment.get());
return;
@@ -175,7 +175,7 @@
m_fragment = createFragmentFromText(selection.toNormalizedRange().get(), evt->text());
if (!m_fragment->firstChild())
return;
- holder = insertFragmentForTestRendering(styleNode);
+ holder = insertFragmentForTestRendering(styleNode.get());
}
removeInterchangeNodes(holder.get());
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
