Title: [109473] branches/chromium/963
- Revision
- 109473
- Author
- [email protected]
- Date
- 2012-03-01 17:51:08 -0800 (Thu, 01 Mar 2012)
Log Message
Merge 107761
BUG=112775
Review URL: https://chromiumcodereview.appspot.com/9570057
Modified Paths
Added Paths
Diff
Copied: branches/chromium/963/LayoutTests/editing/inserting/delete-insignificant-text-crash-expected.txt (from rev 107761, trunk/LayoutTests/editing/inserting/delete-insignificant-text-crash-expected.txt) (0 => 109473)
--- branches/chromium/963/LayoutTests/editing/inserting/delete-insignificant-text-crash-expected.txt (rev 0)
+++ branches/chromium/963/LayoutTests/editing/inserting/delete-insignificant-text-crash-expected.txt 2012-03-02 01:51:08 UTC (rev 109473)
@@ -0,0 +1,3 @@
+This tests deleting a node in DOMCharacterDataModified doesn't result in a crash.
+
+PASS
Copied: branches/chromium/963/LayoutTests/editing/inserting/delete-insignificant-text-crash.html (from rev 107761, trunk/LayoutTests/editing/inserting/delete-insignificant-text-crash.html) (0 => 109473)
--- branches/chromium/963/LayoutTests/editing/inserting/delete-insignificant-text-crash.html (rev 0)
+++ branches/chromium/963/LayoutTests/editing/inserting/delete-insignificant-text-crash.html 2012-03-02 01:51:08 UTC (rev 109473)
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>This tests deleting a node in DOMCharacterDataModified doesn't result in a crash.</p>
+<div id="test" contenteditable></div>
+<script>
+
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+var test = document.getElementById('test');
+test.appendChild(document.createTextNode('a '));
+test.appendChild(document.createTextNode(' '));
+test.appendChild(document.createTextNode('b'));
+test.appendChild(document.createTextNode(' '));
+getSelection().setPosition(test.firstChild.nextSibling, 0);
+document.body.addEventListener('DOMCharacterDataModified', function () {
+ test.removeChild(test.firstChild.nextSibling);
+ if (window.GCController)
+ GCController.collect();
+}, false);
+document.execCommand("InsertText", false, "c");
+
+test.textContent = '';
+document.writeln('PASS');
+
+</script>
+</body>
+</html>
Modified: branches/chromium/963/Source/WebCore/editing/CompositeEditCommand.cpp (109472 => 109473)
--- branches/chromium/963/Source/WebCore/editing/CompositeEditCommand.cpp 2012-03-02 01:44:51 UTC (rev 109472)
+++ branches/chromium/963/Source/WebCore/editing/CompositeEditCommand.cpp 2012-03-02 01:51:08 UTC (rev 109473)
@@ -528,6 +528,8 @@
if (!textNode || start >= end)
return;
+ document()->updateLayout();
+
RenderText* textRenderer = toRenderText(textNode->renderer());
if (!textRenderer)
return;
@@ -610,18 +612,20 @@
if (comparePositions(start, end) >= 0)
return;
- Node* next;
- for (Node* node = start.deprecatedNode(); node; node = next) {
- next = node->traverseNextNode();
- if (node->isTextNode()) {
- Text* textNode = static_cast<Text*>(node);
- int startOffset = node == start.deprecatedNode() ? start.deprecatedEditingOffset() : 0;
- int endOffset = node == end.deprecatedNode() ? end.deprecatedEditingOffset() : static_cast<int>(textNode->length());
- deleteInsignificantText(textNode, startOffset, endOffset);
- }
+ Vector<RefPtr<Text> > nodes;
+ for (Node* node = start.deprecatedNode(); node; node = node->traverseNextNode()) {
+ if (node->isTextNode())
+ nodes.append(static_cast<Text*>(node));
if (node == end.deprecatedNode())
break;
}
+
+ for (size_t i = 0; i < nodes.size(); ++i) {
+ Text* textNode = nodes[i].get();
+ int startOffset = textNode == start.deprecatedNode() ? start.deprecatedEditingOffset() : 0;
+ int endOffset = textNode == end.deprecatedNode() ? end.deprecatedEditingOffset() : static_cast<int>(textNode->length());
+ deleteInsignificantText(textNode, startOffset, endOffset);
+ }
}
void CompositeEditCommand::deleteInsignificantTextDownstream(const Position& pos)
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
