Title: [122877] branches/chromium/1180
- Revision
- 122877
- Author
- [email protected]
- Date
- 2012-07-17 15:05:28 -0700 (Tue, 17 Jul 2012)
Log Message
Merge 122293
BUG=135071
Review URL: https://chromiumcodereview.appspot.com/10704255
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1180/LayoutTests/editing/execCommand/crash-extend-selection-forward-expected.txt (from rev 122293, trunk/LayoutTests/editing/execCommand/crash-extend-selection-forward-expected.txt) (0 => 122877)
--- branches/chromium/1180/LayoutTests/editing/execCommand/crash-extend-selection-forward-expected.txt (rev 0)
+++ branches/chromium/1180/LayoutTests/editing/execCommand/crash-extend-selection-forward-expected.txt 2012-07-17 22:05:28 UTC (rev 122877)
@@ -0,0 +1,3 @@
+EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
+EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
+PASS. WebKit didn't crash.
Copied: branches/chromium/1180/LayoutTests/editing/execCommand/crash-extend-selection-forward.html (from rev 122293, trunk/LayoutTests/editing/execCommand/crash-extend-selection-forward.html) (0 => 122877)
--- branches/chromium/1180/LayoutTests/editing/execCommand/crash-extend-selection-forward.html (rev 0)
+++ branches/chromium/1180/LayoutTests/editing/execCommand/crash-extend-selection-forward.html 2012-07-17 22:05:28 UTC (rev 122877)
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+<body>
+<script src=""
+<script>
+if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+}
+
+function editingTest() {
+ var s = window.getSelection();
+ d = document.getElementById("test1");
+ s.setPosition(d, 0);
+ extendSelectionForwardByLineCommand();
+
+ test1.innerHTML = "PASS. WebKit didn't crash.";
+ if (window.testRunner)
+ testRunner.notifyDone();
+}
+</script>
+<pre id="console"></pre>
+<div id=test1>(required to cause a crash)<object style='content: counters(c, ".") "-"; ' type=text/vbs></object></div>
+<script>
+runEditingTest();
+</script>
+</body>
+</html>
Modified: branches/chromium/1180/Source/WebCore/rendering/style/ContentData.cpp (122876 => 122877)
--- branches/chromium/1180/Source/WebCore/rendering/style/ContentData.cpp 2012-07-17 21:47:50 UTC (rev 122876)
+++ branches/chromium/1180/Source/WebCore/rendering/style/ContentData.cpp 2012-07-17 22:05:28 UTC (rev 122877)
@@ -69,11 +69,11 @@
case CONTENT_NONE:
return true;
case CONTENT_OBJECT:
- return static_cast<const ImageContentData*>(&a)->image() == static_cast<const ImageContentData*>(&b)->image();
+ return *static_cast<const ImageContentData*>(&a)->image() == *static_cast<const ImageContentData*>(&b)->image();
case CONTENT_TEXT:
return static_cast<const TextContentData*>(&a)->text() == static_cast<const TextContentData*>(&b)->text();
case CONTENT_COUNTER:
- return static_cast<const CounterContentData*>(&a)->counter() == static_cast<const CounterContentData*>(&b)->counter();
+ return *static_cast<const CounterContentData*>(&a)->counter() == *static_cast<const CounterContentData*>(&b)->counter();
case CONTENT_QUOTE:
return static_cast<const QuoteContentData*>(&a)->quote() == static_cast<const QuoteContentData*>(&b)->quote();
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
