Copied: branches/chromium/1180/LayoutTests/editing/pasteboard/drop-text-events-sideeffect-crash-expected.txt (from rev 121031, trunk/LayoutTests/editing/pasteboard/drop-text-events-sideeffect-crash-expected.txt) (0 => 122138)
--- branches/chromium/1180/LayoutTests/editing/pasteboard/drop-text-events-sideeffect-crash-expected.txt (rev 0)
+++ branches/chromium/1180/LayoutTests/editing/pasteboard/drop-text-events-sideeffect-crash-expected.txt 2012-07-09 19:33:24 UTC (rev 122138)
@@ -0,0 +1,11 @@
+Ensure safety on side-effect on drop-initiated TextEvent.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS testTargetEditable.innerHTML is 'initialValue'
+PASS testTargetIFrameDocument.body.innerHTML is 'initialBody'
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Copied: branches/chromium/1180/LayoutTests/editing/pasteboard/drop-text-events-sideeffect-crash.html (from rev 121031, trunk/LayoutTests/editing/pasteboard/drop-text-events-sideeffect-crash.html) (0 => 122138)
--- branches/chromium/1180/LayoutTests/editing/pasteboard/drop-text-events-sideeffect-crash.html (rev 0)
+++ branches/chromium/1180/LayoutTests/editing/pasteboard/drop-text-events-sideeffect-crash.html 2012-07-09 19:33:24 UTC (rev 122138)
@@ -0,0 +1,15 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script>
+document.body.contentEditable = "true";
+</script>
+<script src=""
+<script src=""
+</body>
+</html>
Modified: branches/chromium/1180/Source/WebCore/page/DragController.cpp (122137 => 122138)
--- branches/chromium/1180/Source/WebCore/page/DragController.cpp 2012-07-09 19:31:27 UTC (rev 122137)
+++ branches/chromium/1180/Source/WebCore/page/DragController.cpp 2012-07-09 19:33:24 UTC (rev 122138)
@@ -442,10 +442,10 @@
Element* element = elementUnderMouse(m_documentUnderMouse.get(), point);
if (!element)
return false;
- Frame* innerFrame = element->ownerDocument()->frame();
+ RefPtr<Frame> innerFrame = element->ownerDocument()->frame();
ASSERT(innerFrame);
- if (m_page->dragCaretController()->hasCaret() && !dispatchTextInputEventFor(innerFrame, dragData))
+ if (m_page->dragCaretController()->hasCaret() && !dispatchTextInputEventFor(innerFrame.get(), dragData))
return true;
if (dragData->containsColor()) {
@@ -490,7 +490,7 @@
ResourceCacheValidationSuppressor validationSuppressor(cachedResourceLoader);
if (dragIsMove(innerFrame->selection(), dragData) || dragCaret.isContentRichlyEditable()) {
bool chosePlainText = false;
- RefPtr<DocumentFragment> fragment = documentFragmentFromDragData(dragData, innerFrame, range, true, chosePlainText);
+ RefPtr<DocumentFragment> fragment = documentFragmentFromDragData(dragData, innerFrame.get(), range, true, chosePlainText);
if (!fragment || !innerFrame->editor()->shouldInsertFragment(fragment, range, EditorInsertActionDropped)) {
return false;
}
@@ -503,7 +503,7 @@
bool smartInsert = smartDelete && innerFrame->selection()->granularity() == WordGranularity && dragData->canSmartReplace();
applyCommand(MoveSelectionCommand::create(fragment, dragCaret.base(), smartInsert, smartDelete));
} else {
- if (setSelectionToDragCaret(innerFrame, dragCaret, range, point)) {
+ if (setSelectionToDragCaret(innerFrame.get(), dragCaret, range, point)) {
ReplaceSelectionCommand::CommandOptions options = ReplaceSelectionCommand::SelectReplacement | ReplaceSelectionCommand::PreventNesting;
if (dragData->canSmartReplace())
options |= ReplaceSelectionCommand::SmartReplace;
@@ -513,13 +513,13 @@
}
}
} else {
- String text = dragData->asPlainText(innerFrame);
+ String text = dragData->asPlainText(innerFrame.get());
if (text.isEmpty() || !innerFrame->editor()->shouldInsertText(text, range.get(), EditorInsertActionDropped)) {
return false;
}
m_client->willPerformDragDestinationAction(DragDestinationActionEdit, dragData);
- if (setSelectionToDragCaret(innerFrame, dragCaret, range, point))
+ if (setSelectionToDragCaret(innerFrame.get(), dragCaret, range, point))
applyCommand(ReplaceSelectionCommand::create(m_documentUnderMouse.get(), createFragmentFromText(range.get(), text), ReplaceSelectionCommand::SelectReplacement | ReplaceSelectionCommand::MatchStyle | ReplaceSelectionCommand::PreventNesting));
}
