[webkit-changes] [110658] branches/chromium/1025

Tue, 13 Mar 2012 19:29:04 -0700

Title: [110658] branches/chromium/1025

Diff

Copied: branches/chromium/1025/LayoutTests/svg/custom/delete-text-crash-expected.png (from rev 110593, trunk/LayoutTests/svg/custom/delete-text-crash-expected.png)


(Binary files differ)

Copied: branches/chromium/1025/LayoutTests/svg/custom/delete-text-crash-expected.txt (from rev 110593, trunk/LayoutTests/svg/custom/delete-text-crash-expected.txt) (0 => 110658)


--- branches/chromium/1025/LayoutTests/svg/custom/delete-text-crash-expected.txt	                        (rev 0)
+++ branches/chromium/1025/LayoutTests/svg/custom/delete-text-crash-expected.txt	2012-03-14 02:28:58 UTC (rev 110658)
@@ -0,0 +1,14 @@
+layer at (0,0) size 800x616
+  RenderView at (0,0) size 800x600
+layer at (0,0) size 800x616
+  RenderBlock {HTML} at (0,0) size 800x616
+    RenderBody {BODY} at (8,8) size 784x600
+      RenderSVGRoot {svg} at (8,8) size 16x4
+        RenderSVGContainer {g} at (8,8) size 16x4
+          RenderSVGRect {rect} at (8,8) size 0x0 [fill={[type=SOLID] [color=#000000]}] [x=0.00] [y=0.00] [width=0.00] [height=0.00]
+            [filter="x"] RenderSVGResourceFilter {filter} at (-78.40,-60) size 940.80x720
+          RenderSVGText {text} at (0,-15) size 14x19 contains 1 chunk(s)
+            RenderSVGInlineText {#text} at (0,0) size 0x0
+        RenderSVGResourceFilter {filter} [id="x"] [filterUnits=objectBoundingBox] [primitiveUnits=userSpaceOnUse]
+      RenderText {#text} at (0,0) size 0x0
+caret: position 1 of child 0 {#text} of child 3 {text} of child 1 {g} of child 1 {svg} of body

Copied: branches/chromium/1025/LayoutTests/svg/custom/delete-text-crash.html (from rev 110593, trunk/LayoutTests/svg/custom/delete-text-crash.html) (0 => 110658)


--- branches/chromium/1025/LayoutTests/svg/custom/delete-text-crash.html	                        (rev 0)
+++ branches/chromium/1025/LayoutTests/svg/custom/delete-text-crash.html	2012-03-14 02:28:58 UTC (rev 110658)
@@ -0,0 +1,33 @@
+<html>
+<!-- This test passes if there is no crash or assert -->
+<!-- This test should be updated to use DumpAsText once WK81006 is fixed -->
+<!-- The style overflow should be removed once we migrate to DumpAsText as well -->
+<style type="text/css">
+    body {
+        overflow: hidden;
+    }
+</style>
+<script>
+    function testCrash() {
+        q = document.getElementById('root');
+        r = document.createRange();
+        r.selectNodeContents( q.getElementById('t') );
+        window.getSelection().addRange(r)
+        document.designMode='on';
+        document.execCommand('delete');
+        document.execCommand('delete');
+    }
+</script>
+<body _onload_="testCrash()">
+<svg id="root" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+    <g>
+        <rect filter="url(#x)"/>
+        <text>aa</text>
+        <rect id="t"/>
+        <style></style>
+        <text>bb</text>
+    </g>
+    <filter id="x"></filter>
+</svg>
+</body>
+</html>

Modified: branches/chromium/1025/Source/WebCore/rendering/InlineBox.h (110657 => 110658)


--- branches/chromium/1025/Source/WebCore/rendering/InlineBox.h	2012-03-14 02:12:25 UTC (rev 110657)
+++ branches/chromium/1025/Source/WebCore/rendering/InlineBox.h	2012-03-14 02:28:58 UTC (rev 110658)
@@ -284,7 +284,7 @@
     bool isDirty() const { return m_dirty; }
     void markDirty(bool dirty = true) { m_dirty = dirty; }
 
-    void dirtyLineBoxes();
+    virtual void dirtyLineBoxes();
     
     virtual RenderObject::SelectionState selectionState();

Modified: branches/chromium/1025/Source/WebCore/rendering/svg/SVGInlineTextBox.cpp (110657 => 110658)


--- branches/chromium/1025/Source/WebCore/rendering/svg/SVGInlineTextBox.cpp	2012-03-14 02:12:25 UTC (rev 110657)
+++ branches/chromium/1025/Source/WebCore/rendering/svg/SVGInlineTextBox.cpp	2012-03-14 02:28:58 UTC (rev 110658)
@@ -53,6 +53,14 @@
 {
 }
 
+void SVGInlineTextBox::dirtyLineBoxes()
+{
+    InlineTextBox::dirtyLineBoxes();
+
+    // Clear the now stale text fragments
+    clearTextFragments();
+}
+
 int SVGInlineTextBox::offsetForPosition(float, bool) const
 {
     // SVG doesn't use the standard offset <-> position selection system, as it's not suitable for SVGs complex needs.

Modified: branches/chromium/1025/Source/WebCore/rendering/svg/SVGInlineTextBox.h (110657 => 110658)


--- branches/chromium/1025/Source/WebCore/rendering/svg/SVGInlineTextBox.h	2012-03-14 02:12:25 UTC (rev 110657)
+++ branches/chromium/1025/Source/WebCore/rendering/svg/SVGInlineTextBox.h	2012-03-14 02:28:58 UTC (rev 110658)
@@ -57,6 +57,8 @@
     Vector<SVGTextFragment>& textFragments() { return m_textFragments; }
     const Vector<SVGTextFragment>& textFragments() const { return m_textFragments; }
 
+    void dirtyLineBoxes() OVERRIDE;
+
     bool startsNewTextChunk() const { return m_startsNewTextChunk; }
     void setStartsNewTextChunk(bool newTextChunk) { m_startsNewTextChunk = newTextChunk; }
 

_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes

Reply via email to