Title: [118026] branches/chromium/1084
- Revision
- 118026
- Author
- [email protected]
- Date
- 2012-05-22 12:37:30 -0700 (Tue, 22 May 2012)
Log Message
Merge 116545
BUG=127366
Review URL: https://chromiumcodereview.appspot.com/10408066
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1084/LayoutTests/editing/inserting/insert-html-crash-expected.txt (from rev 116545, trunk/LayoutTests/editing/inserting/insert-html-crash-expected.txt) (0 => 118026)
--- branches/chromium/1084/LayoutTests/editing/inserting/insert-html-crash-expected.txt (rev 0)
+++ branches/chromium/1084/LayoutTests/editing/inserting/insert-html-crash-expected.txt 2012-05-22 19:37:30 UTC (rev 118026)
@@ -0,0 +1,4 @@
+PASS successfullyParsed is true
+
+TEST COMPLETE
+PASS. WebKit didn't crash.
Copied: branches/chromium/1084/LayoutTests/editing/inserting/insert-html-crash.html (from rev 116545, trunk/LayoutTests/editing/inserting/insert-html-crash.html) (0 => 118026)
--- branches/chromium/1084/LayoutTests/editing/inserting/insert-html-crash.html (rev 0)
+++ branches/chromium/1084/LayoutTests/editing/inserting/insert-html-crash.html 2012-05-22 19:37:30 UTC (rev 118026)
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<script src=""
+<script>
+window.jsTestIsAsync = true;
+
+if (window.layoutTestController)
+ layoutTestController.waitUntilDone();
+
+document.addEventListener("DOMCharacterDataModified", function() {
+ document.body.innerHTML = "PASS. WebKit didn't crash.";
+ gc();
+ finishJSTest();
+}, true);
+
+document.write("A<br>");
+document.designMode = "on";
+document.execCommand("SelectAll");
+document.execCommand("InsertHTML", false, 4);
+</script>
+<script src=""
+</html>
Modified: branches/chromium/1084/Source/WebCore/editing/ReplaceSelectionCommand.cpp (118025 => 118026)
--- branches/chromium/1084/Source/WebCore/editing/ReplaceSelectionCommand.cpp 2012-05-22 19:34:56 UTC (rev 118025)
+++ branches/chromium/1084/Source/WebCore/editing/ReplaceSelectionCommand.cpp 2012-05-22 19:37:30 UTC (rev 118026)
@@ -1336,7 +1336,7 @@
if (nodeToSplitToAvoidPastingIntoInlineNodesWithStyle(endingSelection().start()))
return false;
- Node* nodeAfterInsertionPos = endingSelection().end().downstream().anchorNode();
+ RefPtr<Node> nodeAfterInsertionPos = endingSelection().end().downstream().anchorNode();
Text* textNode = toText(fragment.firstChild());
// Our fragment creation code handles tabs, spaces, and newlines, so we don't have to worry about those here.
@@ -1345,8 +1345,9 @@
if (end.isNull())
return false;
- if (nodeAfterInsertionPos && nodeAfterInsertionPos->hasTagName(brTag) && shouldRemoveEndBR(nodeAfterInsertionPos, positionBeforeNode(nodeAfterInsertionPos)))
- removeNodeAndPruneAncestors(nodeAfterInsertionPos);
+ if (nodeAfterInsertionPos && nodeAfterInsertionPos->parentNode() && nodeAfterInsertionPos->hasTagName(brTag)
+ && shouldRemoveEndBR(nodeAfterInsertionPos.get(), positionBeforeNode(nodeAfterInsertionPos.get())))
+ removeNodeAndPruneAncestors(nodeAfterInsertionPos.get());
VisibleSelection selectionAfterReplace(m_selectReplacement ? start : end, end);
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
