Title: [112197] trunk
- Revision
- 112197
- Author
- [email protected]
- Date
- 2012-03-26 19:42:48 -0700 (Mon, 26 Mar 2012)
Log Message
Triggers assertion if dragging from outside of <meter> in a shadow tree to inside of it.
https://bugs.webkit.org/show_bug.cgi?id=82177
Reviewed by Dimitri Glazkov.
Source/WebCore:
VisibleSelection::adjustSelectionToAvoidCrossingShadowBoundaries has moved the start position or
the end position to the invalid position, i.e. position after (before) the non-existing node.
This patch fixes the problem, and adds assertion that the selection does not cross shadow boundaries.
Test: fast/dom/shadow/drag-to-meter-in-shadow-crash.html
* editing/VisibleSelection.cpp:
(WebCore::VisibleSelection::adjustSelectionToAvoidCrossingShadowBoundaries):
LayoutTests:
* fast/dom/shadow/drag-to-meter-in-shadow-crash-expected.txt: Added.
* fast/dom/shadow/drag-to-meter-in-shadow-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (112196 => 112197)
--- trunk/LayoutTests/ChangeLog 2012-03-27 02:41:20 UTC (rev 112196)
+++ trunk/LayoutTests/ChangeLog 2012-03-27 02:42:48 UTC (rev 112197)
@@ -1,3 +1,13 @@
+2012-03-26 Shinya Kawanaka <[email protected]>
+
+ Triggers assertion if dragging from outside of <meter> in a shadow tree to inside of it.
+ https://bugs.webkit.org/show_bug.cgi?id=82177
+
+ Reviewed by Dimitri Glazkov.
+
+ * fast/dom/shadow/drag-to-meter-in-shadow-crash-expected.txt: Added.
+ * fast/dom/shadow/drag-to-meter-in-shadow-crash.html: Added.
+
2012-03-26 Adam Barth <[email protected]>
When <img crossorigin> fails the CORS check, we should fire the error event
Added: trunk/LayoutTests/fast/dom/shadow/drag-to-meter-in-shadow-crash-expected.txt (0 => 112197)
--- trunk/LayoutTests/fast/dom/shadow/drag-to-meter-in-shadow-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/shadow/drag-to-meter-in-shadow-crash-expected.txt 2012-03-27 02:42:48 UTC (rev 112197)
@@ -0,0 +1,3 @@
+This test checks selecting from outside of a shadow tree and to inside of a shadow tree won't crash.
+
+PASS
Added: trunk/LayoutTests/fast/dom/shadow/drag-to-meter-in-shadow-crash.html (0 => 112197)
--- trunk/LayoutTests/fast/dom/shadow/drag-to-meter-in-shadow-crash.html (rev 0)
+++ trunk/LayoutTests/fast/dom/shadow/drag-to-meter-in-shadow-crash.html 2012-03-27 02:42:48 UTC (rev 112197)
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>This test checks selecting from outside of a shadow tree and to inside of a shadow tree won't crash.</p>
+<div id='container' style="width:100px; height: 100px"></div>
+<div>PASS</div>
+<script src=""
+<script src=""
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+var container = document.getElementById('container');
+var shadowRoot = new WebKitShadowRoot(container);
+var meter = document.createElement('meter');
+shadowRoot.appendChild(meter);
+
+var midX = meter.offsetLeft + (meter.offsetWidth / 2);
+var midY = meter.offsetTop + (meter.offsetHeight / 2);
+var delta = 40;
+
+eventSender.mouseMoveTo(midX, midY + delta);
+eventSender.mouseDown();
+eventSender.mouseMoveTo(midX, midY);
+eventSender.mouseUp();
+</script>
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (112196 => 112197)
--- trunk/Source/WebCore/ChangeLog 2012-03-27 02:41:20 UTC (rev 112196)
+++ trunk/Source/WebCore/ChangeLog 2012-03-27 02:42:48 UTC (rev 112197)
@@ -1,3 +1,20 @@
+2012-03-26 Shinya Kawanaka <[email protected]>
+
+ Triggers assertion if dragging from outside of <meter> in a shadow tree to inside of it.
+ https://bugs.webkit.org/show_bug.cgi?id=82177
+
+ Reviewed by Dimitri Glazkov.
+
+ VisibleSelection::adjustSelectionToAvoidCrossingShadowBoundaries has moved the start position or
+ the end position to the invalid position, i.e. position after (before) the non-existing node.
+
+ This patch fixes the problem, and adds assertion that the selection does not cross shadow boundaries.
+
+ Test: fast/dom/shadow/drag-to-meter-in-shadow-crash.html
+
+ * editing/VisibleSelection.cpp:
+ (WebCore::VisibleSelection::adjustSelectionToAvoidCrossingShadowBoundaries):
+
2012-03-26 Scott Byer <[email protected]>
Enable layout testing of the scroll animator.
Modified: trunk/Source/WebCore/editing/VisibleSelection.cpp (112196 => 112197)
--- trunk/Source/WebCore/editing/VisibleSelection.cpp 2012-03-27 02:41:20 UTC (rev 112196)
+++ trunk/Source/WebCore/editing/VisibleSelection.cpp 2012-03-27 02:42:48 UTC (rev 112197)
@@ -471,12 +471,14 @@
return;
if (m_baseIsFirst) {
- m_extent = startRootNode ? lastPositionInNode(startRootNode) : positionBeforeNode(endRootNode->shadowAncestorNode());
+ m_extent = startRootNode ? lastPositionInOrAfterNode(startRootNode) : positionBeforeNode(endRootNode->shadowAncestorNode());
m_end = m_extent;
} else {
- m_extent = endRootNode ? firstPositionInNode(endRootNode) : positionAfterNode(startRootNode->shadowAncestorNode());
+ m_extent = endRootNode ? firstPositionInOrBeforeNode(endRootNode) : positionAfterNode(startRootNode->shadowAncestorNode());
m_start = m_extent;
}
+
+ ASSERT(m_start.anchorNode()->treeScope() == m_end.anchorNode()->treeScope());
}
void VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries()
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
