Title: [110462] branches/chromium/1025

Diff

Copied: branches/chromium/1025/LayoutTests/editing/inserting/insert-character-in-first-letter-crash-expected.txt (from rev 110332, trunk/LayoutTests/editing/inserting/insert-character-in-first-letter-crash-expected.txt) (0 => 110462)


--- branches/chromium/1025/LayoutTests/editing/inserting/insert-character-in-first-letter-crash-expected.txt	                        (rev 0)
+++ branches/chromium/1025/LayoutTests/editing/inserting/insert-character-in-first-letter-crash-expected.txt	2012-03-12 19:55:01 UTC (rev 110462)
@@ -0,0 +1,2 @@
+◦◦
+PASS if no assert or crash in debug.

Copied: branches/chromium/1025/LayoutTests/editing/inserting/insert-character-in-first-letter-crash.html (from rev 110332, trunk/LayoutTests/editing/inserting/insert-character-in-first-letter-crash.html) (0 => 110462)


--- branches/chromium/1025/LayoutTests/editing/inserting/insert-character-in-first-letter-crash.html	                        (rev 0)
+++ branches/chromium/1025/LayoutTests/editing/inserting/insert-character-in-first-letter-crash.html	2012-03-12 19:55:01 UTC (rev 110462)
@@ -0,0 +1,35 @@
+<html>
+  <head>
+    <style>
+      #div1 {
+        -webkit-text-security: circle;
+      }
+      #div1::first-letter {
+        display: table-row-group;
+      }
+      #div2 {
+        display: table;
+      }
+      #div2:last-child {
+        display: table-row;
+      }
+    </style>
+    <script>
+      window._onload_ = function() {
+        var div1 = document.getElementById('div1');
+        document.designMode='on';
+        document.execCommand('selectall');
+        document.execCommand('insertText', false, 'Z');
+        document.execCommand('Undo');
+        div1.appendChild(document.createElement('div'));
+        document.execCommand('selectall');
+
+        document.body.appendChild(document.createTextNode("PASS if no assert or crash in debug."));
+
+        if (window.layoutTestController)
+            layoutTestController.dumpAsText();
+     }
+    </script>
+  </head>
+  <body><div id=div1>AB<div id=div2></div></div></body>
+</html>

Modified: branches/chromium/1025/Source/WebCore/rendering/RenderTextFragment.cpp (110461 => 110462)


--- branches/chromium/1025/Source/WebCore/rendering/RenderTextFragment.cpp	2012-03-12 19:52:26 UTC (rev 110461)
+++ branches/chromium/1025/Source/WebCore/rendering/RenderTextFragment.cpp	2012-03-12 19:55:01 UTC (rev 110462)
@@ -33,6 +33,7 @@
     , m_start(startOffset)
     , m_end(length)
     , m_firstLetter(0)
+    , m_allowFragmentReset(true)
 {
 }
 
@@ -42,6 +43,7 @@
     , m_end(str ? str->length() : 0)
     , m_contentString(str)
     , m_firstLetter(0)
+    , m_allowFragmentReset(true)
 {
 }
 
@@ -60,7 +62,9 @@
 
 void RenderTextFragment::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
+    m_allowFragmentReset = false;
     RenderText::styleDidChange(diff, oldStyle);
+    m_allowFragmentReset = true;
 
     if (RenderBlock* block = blockForAccompanyingFirstLetter()) {
         block->style()->removeCachedPseudoStyle(FIRST_LETTER);
@@ -78,15 +82,18 @@
 void RenderTextFragment::setTextInternal(PassRefPtr<StringImpl> text)
 {
     RenderText::setTextInternal(text);
-    if (m_firstLetter) {
-        ASSERT(!m_contentString);
-        m_firstLetter->destroy();
-        m_firstLetter = 0;
+
+    if (m_allowFragmentReset) {
         m_start = 0;
         m_end = textLength();
-        if (Node* t = node()) {
-            ASSERT(!t->renderer());
-            t->setRenderer(this);
+        if (m_firstLetter) {
+            ASSERT(!m_contentString);
+            m_firstLetter->destroy();
+            m_firstLetter = 0;
+            if (Node* t = node()) {
+                ASSERT(!t->renderer());
+                t->setRenderer(this);
+            }
         }
     }
 }

Modified: branches/chromium/1025/Source/WebCore/rendering/RenderTextFragment.h (110461 => 110462)


--- branches/chromium/1025/Source/WebCore/rendering/RenderTextFragment.h	2012-03-12 19:52:26 UTC (rev 110461)
+++ branches/chromium/1025/Source/WebCore/rendering/RenderTextFragment.h	2012-03-12 19:55:01 UTC (rev 110462)
@@ -62,6 +62,7 @@
     unsigned m_end;
     RefPtr<StringImpl> m_contentString;
     RenderObject* m_firstLetter;
+    bool m_allowFragmentReset;
 };
 
 inline RenderTextFragment* toRenderTextFragment(RenderObject* object)
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes

Reply via email to