Diff
Modified: trunk/ChangeLog (117040 => 117041)
--- trunk/ChangeLog 2012-05-15 08:15:09 UTC (rev 117040)
+++ trunk/ChangeLog 2012-05-15 08:24:22 UTC (rev 117041)
@@ -1,3 +1,14 @@
+2012-05-14 Shinya Kawanaka <[email protected]>
+
+ document.execCommand('Indent') in the direct child of ShadowRoot causes a crash.
+ https://bugs.webkit.org/show_bug.cgi?id=86341
+
+ Reviewed by Ryosuke Niwa.
+
+ Exports necessary symbols.
+
+ * Source/autotools/symbols.filter:
+
2012-05-14 Luke Macpherson <[email protected]>
Introduce ENABLE_CSS_VARIABLES compile flag.
Modified: trunk/LayoutTests/ChangeLog (117040 => 117041)
--- trunk/LayoutTests/ChangeLog 2012-05-15 08:15:09 UTC (rev 117040)
+++ trunk/LayoutTests/ChangeLog 2012-05-15 08:24:22 UTC (rev 117041)
@@ -1,3 +1,13 @@
+2012-05-14 Shinya Kawanaka <[email protected]>
+
+ document.execCommand('Indent') in the direct child of ShadowRoot causes a crash.
+ https://bugs.webkit.org/show_bug.cgi?id=86341
+
+ Reviewed by Ryosuke Niwa.
+
+ * editing/shadow/execcommand-indent-in-shadow-expected.txt: Added.
+ * editing/shadow/execcommand-indent-in-shadow.html: Added.
+
2012-05-15 Kristóf Kosztyó <[email protected]>
[Qt] 6 SVG tests assert after r107207
Added: trunk/LayoutTests/editing/shadow/execcommand-indent-in-shadow-expected.txt (0 => 117041)
--- trunk/LayoutTests/editing/shadow/execcommand-indent-in-shadow-expected.txt (rev 0)
+++ trunk/LayoutTests/editing/shadow/execcommand-indent-in-shadow-expected.txt 2012-05-15 08:24:22 UTC (rev 117041)
@@ -0,0 +1,13 @@
+In this test, we do execCommand('Indent') in the direct child of ShadowRoot to confirm a crash doesn't happen.
+
+
+
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
+
+
+
+
Added: trunk/LayoutTests/editing/shadow/execcommand-indent-in-shadow.html (0 => 117041)
--- trunk/LayoutTests/editing/shadow/execcommand-indent-in-shadow.html (rev 0)
+++ trunk/LayoutTests/editing/shadow/execcommand-indent-in-shadow.html 2012-05-15 08:24:22 UTC (rev 117041)
@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+<script src=""
+<script src=""
+</head>
+<body>
+
+<p>In this test, we do execCommand('Indent') in the direct child of ShadowRoot
+to confirm a crash doesn't happen.</p>
+
+<div id="container" contenteditable></div>
+<pre id="console"></div>
+
+<script>
+var shadowRoot = new WebKitShadowRoot(container);
+shadowRoot.innerHTML = "<span contenteditable>Kotori Otonashi</span>"
+var span = shadowRoot.firstChild;
+
+mouseMoveToElem(span);
+eventSender.mouseDown();
+eventSender.mouseUp();
+
+document.execCommand('Indent');
+
+var successfullyParsed = true;
+</script>
+<script src=""
+</body>
+
+</html>
Modified: trunk/Source/WebCore/ChangeLog (117040 => 117041)
--- trunk/Source/WebCore/ChangeLog 2012-05-15 08:15:09 UTC (rev 117040)
+++ trunk/Source/WebCore/ChangeLog 2012-05-15 08:24:22 UTC (rev 117041)
@@ -1,3 +1,33 @@
+2012-05-14 Shinya Kawanaka <[email protected]>
+
+ document.execCommand('Indent') in the direct child of ShadowRoot causes a crash.
+ https://bugs.webkit.org/show_bug.cgi?id=86341
+
+ Reviewed by Ryosuke Niwa.
+
+ When document.execCommand('Indent') is executed in the direct child of ShadowRoot,
+ the scope variable of TextIterator becomes ShadowRoot. However, an element is assumed for it,
+ so a crash happended.
+
+ This patch enables TextIterator to have ShadowRoot as a scope variable.
+
+ Test: editing/shadow/execcommand-indent-in-shadow.html
+
+ * WebCore.exp.in:
+ * editing/ApplyBlockElementCommand.cpp:
+ (WebCore::ApplyBlockElementCommand::doApply):
+ * editing/InsertListCommand.cpp:
+ (WebCore::InsertListCommand::doApply):
+ * editing/TextIterator.cpp:
+ (WebCore::TextIterator::rangeFromLocationAndLength):
+ * editing/TextIterator.h:
+ (TextIterator):
+ * editing/htmlediting.cpp:
+ (WebCore::indexForVisiblePosition):
+ (WebCore::visiblePositionForIndex):
+ * editing/htmlediting.h:
+ (WebCore):
+
2012-05-14 Shinya Kawanaka <[email protected]>
Node::shadowTreeRootNode() should return ShadowRoot instead of Node.
Modified: trunk/Source/WebCore/WebCore.exp.in (117040 => 117041)
--- trunk/Source/WebCore/WebCore.exp.in 2012-05-15 08:15:09 UTC (rev 117040)
+++ trunk/Source/WebCore/WebCore.exp.in 2012-05-15 08:24:22 UTC (rev 117041)
@@ -284,7 +284,7 @@
__ZN7WebCore12SpellChecker17didCheckSucceededEiRKN3WTF6VectorINS_18TextCheckingResultELm0EEE
__ZN7WebCore12TextEncodingC1ERKN3WTF6StringE
__ZN7WebCore12TextIterator11rangeLengthEPKNS_5RangeEb
-__ZN7WebCore12TextIterator26rangeFromLocationAndLengthEPNS_7ElementEiib
+__ZN7WebCore12TextIterator26rangeFromLocationAndLengthEPNS_13ContainerNodeEiib
__ZN7WebCore12TextIterator29getLocationAndLengthFromRangeEPNS_7ElementEPKNS_5RangeERmS6_
__ZN7WebCore12TextIterator7advanceEv
__ZN7WebCore12TextIterator8subrangeEPNS_5RangeEii
Modified: trunk/Source/WebCore/editing/ApplyBlockElementCommand.cpp (117040 => 117041)
--- trunk/Source/WebCore/editing/ApplyBlockElementCommand.cpp 2012-05-15 08:15:09 UTC (rev 117040)
+++ trunk/Source/WebCore/editing/ApplyBlockElementCommand.cpp 2012-05-15 08:24:22 UTC (rev 117041)
@@ -80,9 +80,9 @@
VisiblePosition endOfSelection = selection.visibleEnd();
ASSERT(!startOfSelection.isNull());
ASSERT(!endOfSelection.isNull());
- RefPtr<Element> startScope;
+ RefPtr<ContainerNode> startScope;
int startIndex = indexForVisiblePosition(startOfSelection, startScope);
- RefPtr<Element> endScope;
+ RefPtr<ContainerNode> endScope;
int endIndex = indexForVisiblePosition(endOfSelection, endScope);
formatSelection(startOfSelection, endOfSelection);
Modified: trunk/Source/WebCore/editing/InsertListCommand.cpp (117040 => 117041)
--- trunk/Source/WebCore/editing/InsertListCommand.cpp 2012-05-15 08:15:09 UTC (rev 117040)
+++ trunk/Source/WebCore/editing/InsertListCommand.cpp 2012-05-15 08:24:22 UTC (rev 117041)
@@ -152,7 +152,7 @@
// FIXME: This is an inefficient way to keep selection alive because indexForVisiblePosition walks from
// the beginning of the document to the endOfSelection everytime this code is executed.
// But not using index is hard because there are so many ways we can lose selection inside doApplyForSingleParagraph.
- RefPtr<Element> scope;
+ RefPtr<ContainerNode> scope;
int indexForEndOfSelection = indexForVisiblePosition(endOfSelection, scope);
doApplyForSingleParagraph(forceCreateList, listTag, currentSelection.get());
if (endOfSelection.isNull() || endOfSelection.isOrphan() || startOfLastParagraph.isNull() || startOfLastParagraph.isOrphan()) {
Modified: trunk/Source/WebCore/editing/TextIterator.cpp (117040 => 117041)
--- trunk/Source/WebCore/editing/TextIterator.cpp 2012-05-15 08:15:09 UTC (rev 117040)
+++ trunk/Source/WebCore/editing/TextIterator.cpp 2012-05-15 08:24:22 UTC (rev 117041)
@@ -2403,7 +2403,7 @@
return characterSubrange(entireRangeIterator, characterOffset, characterCount);
}
-PassRefPtr<Range> TextIterator::rangeFromLocationAndLength(Element* scope, int rangeLocation, int rangeLength, bool forSelectionPreservation)
+PassRefPtr<Range> TextIterator::rangeFromLocationAndLength(ContainerNode* scope, int rangeLocation, int rangeLength, bool forSelectionPreservation)
{
RefPtr<Range> resultRange = scope->document()->createRange();
Modified: trunk/Source/WebCore/editing/TextIterator.h (117040 => 117041)
--- trunk/Source/WebCore/editing/TextIterator.h 2012-05-15 08:15:09 UTC (rev 117040)
+++ trunk/Source/WebCore/editing/TextIterator.h 2012-05-15 08:24:22 UTC (rev 117041)
@@ -100,7 +100,7 @@
Node* node() const;
static int rangeLength(const Range*, bool spacesForReplacedElements = false);
- static PassRefPtr<Range> rangeFromLocationAndLength(Element* scope, int rangeLocation, int rangeLength, bool spacesForReplacedElements = false);
+ static PassRefPtr<Range> rangeFromLocationAndLength(ContainerNode* scope, int rangeLocation, int rangeLength, bool spacesForReplacedElements = false);
static bool getLocationAndLengthFromRange(Element* scope, const Range*, size_t& location, size_t& length);
static PassRefPtr<Range> subrange(Range* entireRange, int characterOffset, int characterCount);
Modified: trunk/Source/WebCore/editing/htmlediting.cpp (117040 => 117041)
--- trunk/Source/WebCore/editing/htmlediting.cpp 2012-05-15 08:15:09 UTC (rev 117040)
+++ trunk/Source/WebCore/editing/htmlediting.cpp 2012-05-15 08:24:22 UTC (rev 117041)
@@ -1085,19 +1085,20 @@
// opertion is unreliable. TextIterator's TextIteratorEmitsCharactersBetweenAllVisiblePositions mode needs to be fixed,
// or these functions need to be changed to iterate using actual VisiblePositions.
// FIXME: Deploy these functions everywhere that TextIterators are used to convert between VisiblePositions and indices.
-int indexForVisiblePosition(const VisiblePosition& visiblePosition, RefPtr<Element>& scope)
+
+int indexForVisiblePosition(const VisiblePosition& visiblePosition, RefPtr<ContainerNode>& scope)
{
if (visiblePosition.isNull())
return 0;
Position p(visiblePosition.deepEquivalent());
Document* document = p.anchorNode()->document();
- Node* shadowRoot = p.anchorNode()->shadowTreeRootNode();
+ ContainerNode* shadowRoot = p.anchorNode()->shadowTreeRootNode();
if (shadowRoot) {
// Use the shadow root for form elements, since TextIterators will not enter shadow content.
- ASSERT(shadowRoot->isElementNode());
- scope = static_cast<Element*>(shadowRoot);
+ ASSERT(shadowRoot->isElementNode() || shadowRoot->isShadowRoot());
+ scope = shadowRoot;
} else
scope = document->documentElement();
@@ -1106,7 +1107,7 @@
return TextIterator::rangeLength(range.get(), true);
}
-VisiblePosition visiblePositionForIndex(int index, Element *scope)
+VisiblePosition visiblePositionForIndex(int index, ContainerNode* scope)
{
RefPtr<Range> range = TextIterator::rangeFromLocationAndLength(scope, index, 0, true);
// Check for an invalid index. Certain editing operations invalidate indices because
Modified: trunk/Source/WebCore/editing/htmlediting.h (117040 => 117041)
--- trunk/Source/WebCore/editing/htmlediting.h 2012-05-15 08:15:09 UTC (rev 117040)
+++ trunk/Source/WebCore/editing/htmlediting.h 2012-05-15 08:24:22 UTC (rev 117041)
@@ -180,8 +180,8 @@
int comparePositions(const VisiblePosition&, const VisiblePosition&);
-int indexForVisiblePosition(const VisiblePosition&, RefPtr<Element>& scope);
-VisiblePosition visiblePositionForIndex(int index, Element *scope);
+int indexForVisiblePosition(const VisiblePosition&, RefPtr<ContainerNode>& scope);
+VisiblePosition visiblePositionForIndex(int index, ContainerNode* scope);
// -------------------------------------------------------------------------
// Range
Modified: trunk/Source/WebKit/chromium/ChangeLog (117040 => 117041)
--- trunk/Source/WebKit/chromium/ChangeLog 2012-05-15 08:15:09 UTC (rev 117040)
+++ trunk/Source/WebKit/chromium/ChangeLog 2012-05-15 08:24:22 UTC (rev 117041)
@@ -1,3 +1,13 @@
+2012-05-14 Shinya Kawanaka <[email protected]>
+
+ document.execCommand('Indent') in the direct child of ShadowRoot causes a crash.
+ https://bugs.webkit.org/show_bug.cgi?id=86341
+
+ Reviewed by Ryosuke Niwa.
+
+ * src/WebRange.cpp:
+ (WebKit::WebRange::fromDocumentRange):
+
2012-05-14 Shinya Kawanaka <[email protected]>
Node::shadowTreeRootNode() should return ShadowRoot instead of Node.
Modified: trunk/Source/WebKit/chromium/src/WebRange.cpp (117040 => 117041)
--- trunk/Source/WebKit/chromium/src/WebRange.cpp 2012-05-15 08:15:09 UTC (rev 117040)
+++ trunk/Source/WebKit/chromium/src/WebRange.cpp 2012-05-15 08:24:22 UTC (rev 117041)
@@ -32,9 +32,11 @@
#include "WebRange.h"
#include "Document.h"
+#include "Element.h"
#include "Frame.h"
#include "FrameView.h"
#include "Range.h"
+#include "ShadowRoot.h"
#include "TextIterator.h"
#include "WebFrameImpl.h"
#include "WebNode.h"
@@ -97,7 +99,7 @@
{
WebCore::Frame* webFrame = static_cast<WebFrameImpl*>(frame)->frame();
Element* selectionRoot = webFrame->selection()->rootEditableElement();
- Element* scope = selectionRoot ? selectionRoot : webFrame->document()->documentElement();
+ ContainerNode* scope = selectionRoot ? selectionRoot : webFrame->document()->documentElement();
return TextIterator::rangeFromLocationAndLength(scope, start, length);
}
Modified: trunk/Source/WebKit2/ChangeLog (117040 => 117041)
--- trunk/Source/WebKit2/ChangeLog 2012-05-15 08:15:09 UTC (rev 117040)
+++ trunk/Source/WebKit2/ChangeLog 2012-05-15 08:24:22 UTC (rev 117041)
@@ -1,3 +1,15 @@
+2012-05-14 Shinya Kawanaka <[email protected]>
+
+ document.execCommand('Indent') in the direct child of ShadowRoot causes a crash.
+ https://bugs.webkit.org/show_bug.cgi?id=86341
+
+ Reviewed by Ryosuke Niwa.
+
+ Exports necessary symbols.
+
+ * win/WebKit2.def:
+ * win/WebKit2CFLite.def:
+
2012-05-14 Luke Macpherson <[email protected]>
Introduce ENABLE_CSS_VARIABLES compile flag.
Modified: trunk/Source/WebKit2/win/WebKit2.def (117040 => 117041)
--- trunk/Source/WebKit2/win/WebKit2.def 2012-05-15 08:15:09 UTC (rev 117040)
+++ trunk/Source/WebKit2/win/WebKit2.def 2012-05-15 08:24:22 UTC (rev 117041)
@@ -199,7 +199,7 @@
?page@Document@WebCore@@QBEPAVPage@2@XZ
?paintControlTints@FrameView@WebCore@@AAEXXZ
?placeholderShouldBeVisible@HTMLTextFormControlElement@WebCore@@QBE_NXZ
- ?rangeFromLocationAndLength@TextIterator@WebCore@@SA?AV?$PassRefPtr@VRange@WebCore@@@WTF@@PAVElement@2@HH_N@Z
+ ?rangeFromLocationAndLength@TextIterator@WebCore@@SA?AV?$PassRefPtr@VRange@WebCore@@@WTF@@PAVContainerNode@2@HH_N@Z
?remove@String@WTF@@QAEXIH@Z
?reverseFind@StringImpl@WTF@@QAEI_WI@Z
?s_frontendCounter@InspectorInstrumentation@WebCore@@0HA
Modified: trunk/Source/WebKit2/win/WebKit2CFLite.def (117040 => 117041)
--- trunk/Source/WebKit2/win/WebKit2CFLite.def 2012-05-15 08:15:09 UTC (rev 117040)
+++ trunk/Source/WebKit2/win/WebKit2CFLite.def 2012-05-15 08:24:22 UTC (rev 117041)
@@ -192,7 +192,7 @@
?page@Document@WebCore@@QBEPAVPage@2@XZ
?paintControlTints@FrameView@WebCore@@AAEXXZ
?placeholderShouldBeVisible@HTMLTextFormControlElement@WebCore@@QBE_NXZ
- ?rangeFromLocationAndLength@TextIterator@WebCore@@SA?AV?$PassRefPtr@VRange@WebCore@@@WTF@@PAVElement@2@HH_N@Z
+ ?rangeFromLocationAndLength@TextIterator@WebCore@@SA?AV?$PassRefPtr@VRange@WebCore@@@WTF@@PAVContainerNode@2@HH_N@Z
?remove@String@WTF@@QAEXIH@Z
?reverseFind@StringImpl@WTF@@QAEI_WI@Z
?s_frontendCounter@InspectorInstrumentation@WebCore@@0HA
Modified: trunk/Source/autotools/symbols.filter (117040 => 117041)
--- trunk/Source/autotools/symbols.filter 2012-05-15 08:15:09 UTC (rev 117040)
+++ trunk/Source/autotools/symbols.filter 2012-05-15 08:24:22 UTC (rev 117041)
@@ -45,7 +45,7 @@
_ZN7WebCore10ShadowRoot6createEPNS_7ElementERi;
_ZN7WebCore11EventTarget17toGeneratedStreamEv;
_ZN7WebCore11EventTarget8toStreamEv;
-_ZN7WebCore12TextIterator26rangeFromLocationAndLengthEPNS_7ElementEiib;
+_ZN7WebCore12TextIterator26rangeFromLocationAndLengthEPNS_13ContainerNodeEiib;
_ZN7WebCore12TextIterator29getLocationAndLengthFromRangeEPNS_7ElementEPKNS_5RangeERjS6_;
_ZN7WebCore12TextIterator29getLocationAndLengthFromRangeEPNS_7ElementEPKNS_5RangeERmS6_;
_ZN7WebCore13createWrapperEPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectEPNS_4NodeE;
