Title: [94511] trunk
- Revision
- 94511
- Author
- [email protected]
- Date
- 2011-09-04 22:22:36 -0700 (Sun, 04 Sep 2011)
Log Message
Crash in Range::processAncestorsAndTheirSiblings.
https://bugs.webkit.org/show_bug.cgi?id=67556
Reviewed by Ryosuke Niwa.
Source/WebCore:
Create a temporary RefPtr Node vector to keep all the ancestor's
childs so that we don't access removed child nodes.
Test: fast/dom/Range/range-delete-contents-event-fire-crash.html
* dom/Range.cpp:
(WebCore::Range::processContents):
(WebCore::Range::processAncestorsAndTheirSiblings):
LayoutTests:
Tests that we do not crash when removing contents of
a range from the document.
* fast/dom/Range/range-delete-contents-event-fire-crash-expected.txt: Added.
* fast/dom/Range/range-delete-contents-event-fire-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (94510 => 94511)
--- trunk/LayoutTests/ChangeLog 2011-09-05 04:46:22 UTC (rev 94510)
+++ trunk/LayoutTests/ChangeLog 2011-09-05 05:22:36 UTC (rev 94511)
@@ -1,3 +1,16 @@
+2011-09-04 Abhishek Arya <[email protected]>
+
+ Crash in Range::processAncestorsAndTheirSiblings.
+ https://bugs.webkit.org/show_bug.cgi?id=67556
+
+ Reviewed by Ryosuke Niwa.
+
+ Tests that we do not crash when removing contents of
+ a range from the document.
+
+ * fast/dom/Range/range-delete-contents-event-fire-crash-expected.txt: Added.
+ * fast/dom/Range/range-delete-contents-event-fire-crash.html: Added.
+
2011-09-04 Jeremy Apthorp <[email protected]>
Don't detach elements from the render tree when entering fullscreen mode
Added: trunk/LayoutTests/fast/dom/Range/range-delete-contents-event-fire-crash-expected.txt (0 => 94511)
--- trunk/LayoutTests/fast/dom/Range/range-delete-contents-event-fire-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/Range/range-delete-contents-event-fire-crash-expected.txt 2011-09-05 05:22:36 UTC (rev 94511)
@@ -0,0 +1,2 @@
+
+PASS
Added: trunk/LayoutTests/fast/dom/Range/range-delete-contents-event-fire-crash.html (0 => 94511)
--- trunk/LayoutTests/fast/dom/Range/range-delete-contents-event-fire-crash.html (rev 0)
+++ trunk/LayoutTests/fast/dom/Range/range-delete-contents-event-fire-crash.html 2011-09-05 05:22:36 UTC (rev 94511)
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+<div id="test1">
+<input id="test2"/>
+<input id="test3"/>
+<ol></ol>
+</div>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+function runTest() {
+ var range = document.createRange();
+ var test1 = document.getElementById("test1");
+ var test2 = document.getElementById("test2");
+ var test3 = document.getElementById("test3");
+
+ range.setStartBefore(test2);
+ range.selectNodeContents(test3);
+ range.setEndAfter(test1);
+ range.commonAncestorContainer;
+ range.deleteContents();
+}
+
+document.addEventListener("DOMSubtreeModified", runTest, true);
+document.body.appendChild(document.createTextNode("PASS"));
+</script>
+</html>
\ No newline at end of file
Modified: trunk/Source/WebCore/ChangeLog (94510 => 94511)
--- trunk/Source/WebCore/ChangeLog 2011-09-05 04:46:22 UTC (rev 94510)
+++ trunk/Source/WebCore/ChangeLog 2011-09-05 05:22:36 UTC (rev 94511)
@@ -1,3 +1,19 @@
+2011-09-04 Abhishek Arya <[email protected]>
+
+ Crash in Range::processAncestorsAndTheirSiblings.
+ https://bugs.webkit.org/show_bug.cgi?id=67556
+
+ Reviewed by Ryosuke Niwa.
+
+ Create a temporary RefPtr Node vector to keep all the ancestor's
+ childs so that we don't access removed child nodes.
+
+ Test: fast/dom/Range/range-delete-contents-event-fire-crash.html
+
+ * dom/Range.cpp:
+ (WebCore::Range::processContents):
+ (WebCore::Range::processAncestorsAndTheirSiblings):
+
2011-09-04 Jeremy Apthorp <[email protected]>
Don't detach elements from the render tree when entering fullscreen mode
Modified: trunk/Source/WebCore/dom/Range.cpp (94510 => 94511)
--- trunk/Source/WebCore/dom/Range.cpp 2011-09-05 04:46:22 UTC (rev 94510)
+++ trunk/Source/WebCore/dom/Range.cpp 2011-09-05 05:22:36 UTC (rev 94511)
@@ -58,6 +58,8 @@
static WTF::RefCountedLeakCounter rangeCounter("Range");
#endif
+typedef Vector<RefPtr<Node> > NodeVector;
+
inline Range::Range(PassRefPtr<Document> ownerDocument)
: m_ownerDocument(ownerDocument)
, m_start(m_ownerDocument)
@@ -681,8 +683,6 @@
PassRefPtr<DocumentFragment> Range::processContents(ActionType action, ExceptionCode& ec)
{
- typedef Vector<RefPtr<Node> > NodeVector;
-
RefPtr<DocumentFragment> fragment;
if (action == EXTRACT_CONTENTS || action == CLONE_CONTENTS)
fragment = DocumentFragment::create(m_ownerDocument.get());
@@ -896,9 +896,14 @@
// FIXME: This assertion may fail if DOM is modified during mutation event
// FIXME: Share code with Range::processNodes
ASSERT(!firstChildInAncestorToProcess || firstChildInAncestorToProcess->parentNode() == ancestor);
- RefPtr<Node> next;
- for (Node* child = firstChildInAncestorToProcess.get(); child; child = next.get()) {
- next = direction == ProcessContentsForward ? child->nextSibling() : child->previousSibling();
+
+ NodeVector nodes;
+ for (Node* child = firstChildInAncestorToProcess.get(); child;
+ child = (direction == ProcessContentsForward) ? child->nextSibling() : child->previousSibling())
+ nodes.append(child);
+
+ for (NodeVector::const_iterator it = nodes.begin(); it != nodes.end(); it++) {
+ Node* child = it->get();
switch (action) {
case DELETE_CONTENTS:
ancestor->removeChild(child, ec);
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
