Title: [96948] branches/chromium/874
- Revision
- 96948
- Author
- infe...@chromium.org
- Date
- 2011-10-07 09:43:14 -0700 (Fri, 07 Oct 2011)
Log Message
Merge 96868 - Crash in VisiblePosition::canonicalPosition.
BUG=99138
Review URL: http://codereview.chromium.org/8199007
Modified Paths
Added Paths
Diff
Copied: branches/chromium/874/LayoutTests/editing/selection/selection-plugin-clear-crash-expected.txt (from rev 96868, trunk/LayoutTests/editing/selection/selection-plugin-clear-crash-expected.txt) (0 => 96948)
--- branches/chromium/874/LayoutTests/editing/selection/selection-plugin-clear-crash-expected.txt (rev 0)
+++ branches/chromium/874/LayoutTests/editing/selection/selection-plugin-clear-crash-expected.txt 2011-10-07 16:43:14 UTC (rev 96948)
@@ -0,0 +1 @@
+PASS
Copied: branches/chromium/874/LayoutTests/editing/selection/selection-plugin-clear-crash.html (from rev 96868, trunk/LayoutTests/editing/selection/selection-plugin-clear-crash.html) (0 => 96948)
--- branches/chromium/874/LayoutTests/editing/selection/selection-plugin-clear-crash.html (rev 0)
+++ branches/chromium/874/LayoutTests/editing/selection/selection-plugin-clear-crash.html 2011-10-07 16:43:14 UTC (rev 96948)
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+function runTest()
+{
+ var obj = document.getElementById("test");
+ var s = window.getSelection();
+ s.setPosition(obj, 0);
+ document.body.innerHTML = "PASS";
+}
+</script>
+<body _onload_="runTest()">
+<div>
+<object id="test"></object>
+<embed type="application/x-webkit-test-netscape" cleardocumentduringnew></embed>
+</div>
+</body>
+</html>
\ No newline at end of file
Modified: branches/chromium/874/Source/WebCore/editing/VisiblePosition.cpp (96947 => 96948)
--- branches/chromium/874/Source/WebCore/editing/VisiblePosition.cpp 2011-10-07 16:42:54 UTC (rev 96947)
+++ branches/chromium/874/Source/WebCore/editing/VisiblePosition.cpp 2011-10-07 16:43:14 UTC (rev 96948)
@@ -484,11 +484,11 @@
if (position.isNull())
return Position();
- Node* node = position.containerNode();
-
ASSERT(position.document());
position.document()->updateLayoutIgnorePendingStylesheets();
+ Node* node = position.containerNode();
+
Position candidate = position.upstream();
if (candidate.isCandidate())
return candidate;
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
