Title: [104088] branches/safari-534.54-branch
Diff
Modified: branches/safari-534.54-branch/LayoutTests/ChangeLog (104087 => 104088)
--- branches/safari-534.54-branch/LayoutTests/ChangeLog 2012-01-04 23:33:06 UTC (rev 104087)
+++ branches/safari-534.54-branch/LayoutTests/ChangeLog 2012-01-04 23:45:58 UTC (rev 104088)
@@ -1,5 +1,19 @@
2011-1-4 Lucas Forschler <[email protected]>
+ Merge 96868
+
+ 2011-10-06 Abhishek Arya <[email protected]>
+
+ Crash in VisiblePosition::canonicalPosition.
+ https://bugs.webkit.org/show_bug.cgi?id=69568
+
+ Reviewed by Ryosuke Niwa.
+
+ * editing/selection/selection-plugin-clear-crash-expected.txt: Added.
+ * editing/selection/selection-plugin-clear-crash.html: Added.
+
+2011-1-4 Lucas Forschler <[email protected]>
+
Merge 96834
2011-10-06 Dan Bernstein <[email protected]>
Copied: branches/safari-534.54-branch/LayoutTests/editing/selection/selection-plugin-clear-crash-expected.txt (from rev 96868, trunk/LayoutTests/editing/selection/selection-plugin-clear-crash-expected.txt) (0 => 104088)
--- branches/safari-534.54-branch/LayoutTests/editing/selection/selection-plugin-clear-crash-expected.txt (rev 0)
+++ branches/safari-534.54-branch/LayoutTests/editing/selection/selection-plugin-clear-crash-expected.txt 2012-01-04 23:45:58 UTC (rev 104088)
@@ -0,0 +1 @@
+PASS
Copied: branches/safari-534.54-branch/LayoutTests/editing/selection/selection-plugin-clear-crash.html (from rev 96868, trunk/LayoutTests/editing/selection/selection-plugin-clear-crash.html) (0 => 104088)
--- branches/safari-534.54-branch/LayoutTests/editing/selection/selection-plugin-clear-crash.html (rev 0)
+++ branches/safari-534.54-branch/LayoutTests/editing/selection/selection-plugin-clear-crash.html 2012-01-04 23:45:58 UTC (rev 104088)
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+function runTest()
+{
+ var obj = document.getElementById("test");
+ var s = window.getSelection();
+ s.setPosition(obj, 0);
+ document.body.innerHTML = "PASS";
+}
+</script>
+<body _onload_="runTest()">
+<div>
+<object id="test"></object>
+<embed type="application/x-webkit-test-netscape" cleardocumentduringnew></embed>
+</div>
+</body>
+</html>
\ No newline at end of file
Modified: branches/safari-534.54-branch/Source/WebCore/ChangeLog (104087 => 104088)
--- branches/safari-534.54-branch/Source/WebCore/ChangeLog 2012-01-04 23:33:06 UTC (rev 104087)
+++ branches/safari-534.54-branch/Source/WebCore/ChangeLog 2012-01-04 23:45:58 UTC (rev 104088)
@@ -1,5 +1,24 @@
2011-1-4 Lucas Forschler <[email protected]>
+ Merge 96868
+
+ 2011-10-06 Abhishek Arya <[email protected]>
+
+ Crash in VisiblePosition::canonicalPosition.
+ https://bugs.webkit.org/show_bug.cgi?id=69568
+
+ Reviewed by Ryosuke Niwa.
+
+ Move the position's containerNode calculation after layout is
+ complete(in updateLayoutIgnorePendingStylesheets).
+
+ Test: editing/selection/selection-plugin-clear-crash.html
+
+ * editing/VisiblePosition.cpp:
+ (WebCore::VisiblePosition::canonicalPosition):
+
+2011-1-4 Lucas Forschler <[email protected]>
+
Merge 96834
2011-10-06 Dan Bernstein <[email protected]>
Modified: branches/safari-534.54-branch/Source/WebCore/editing/VisiblePosition.cpp (104087 => 104088)
--- branches/safari-534.54-branch/Source/WebCore/editing/VisiblePosition.cpp 2012-01-04 23:33:06 UTC (rev 104087)
+++ branches/safari-534.54-branch/Source/WebCore/editing/VisiblePosition.cpp 2012-01-04 23:45:58 UTC (rev 104088)
@@ -483,11 +483,11 @@
if (position.isNull())
return Position();
- Node* node = position.containerNode();
-
ASSERT(position.document());
position.document()->updateLayoutIgnorePendingStylesheets();
+ Node* node = position.containerNode();
+
Position candidate = position.upstream();
if (candidate.isCandidate())
return candidate;
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
