Title: [126667] branches/chromium/1229
- Revision
- 126667
- Author
- [email protected]
- Date
- 2012-08-24 17:58:42 -0700 (Fri, 24 Aug 2012)
Log Message
Merge 124914
BUG=138915
Review URL: https://chromiumcodereview.appspot.com/10878069
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1229/LayoutTests/fast/dom/clone-node-load-event-crash-expected.txt (from rev 124914, trunk/LayoutTests/fast/dom/clone-node-load-event-crash-expected.txt) (0 => 126667)
--- branches/chromium/1229/LayoutTests/fast/dom/clone-node-load-event-crash-expected.txt (rev 0)
+++ branches/chromium/1229/LayoutTests/fast/dom/clone-node-load-event-crash-expected.txt 2012-08-25 00:58:42 UTC (rev 126667)
@@ -0,0 +1,2 @@
+Tests that we don't crash due to incorrect load event firing during cloneNode.
+PASS. WebKit didn't crash.
Copied: branches/chromium/1229/LayoutTests/fast/dom/clone-node-load-event-crash.html (from rev 124914, trunk/LayoutTests/fast/dom/clone-node-load-event-crash.html) (0 => 126667)
--- branches/chromium/1229/LayoutTests/fast/dom/clone-node-load-event-crash.html (rev 0)
+++ branches/chromium/1229/LayoutTests/fast/dom/clone-node-load-event-crash.html 2012-08-25 00:58:42 UTC (rev 126667)
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html>
+<body>
+<script>
+</script>
+<div contenteditable='true' id='div'>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+var div = document.getElementById('div');
+div.focus();
+document.body.contentEditable = 'true';
+
+function crash() {
+ embed = document.createElement('embed');
+ embed.setAttribute('type', 'text/foo');
+ document.body.appendChild(embed);
+ document.body.cloneNode(true);
+}
+
+function removeContent() {
+ document.body.innerHTML = "Tests that we don't crash due to incorrect load event firing during cloneNode. <br />\
+ PASS. WebKit didn't crash.";
+}
+
+window.addEventListener('load', removeContent, false);
+document.addEventListener('DOMContentLoaded', crash, false);
+</script>
+</body>
+</html>
Modified: branches/chromium/1229/Source/WebCore/dom/ContainerNode.cpp (126666 => 126667)
--- branches/chromium/1229/Source/WebCore/dom/ContainerNode.cpp 2012-08-25 00:50:05 UTC (rev 126666)
+++ branches/chromium/1229/Source/WebCore/dom/ContainerNode.cpp 2012-08-25 00:58:42 UTC (rev 126667)
@@ -690,22 +690,16 @@
void ContainerNode::cloneChildNodes(ContainerNode *clone)
{
- // disable the delete button so it's elements are not serialized into the markup
- bool isEditorEnabled = false;
- if (document()->frame() && document()->frame()->editor()->canEdit()) {
- FrameSelection* selection = document()->frame()->selection();
- Element* root = selection ? selection->rootEditableElement() : 0;
- isEditorEnabled = root && isDescendantOf(root);
+ HTMLElement* deleteButtonContainerElement = 0;
+ if (Frame* frame = document()->frame())
+ deleteButtonContainerElement = frame->editor()->deleteButtonController()->containerElement();
- if (isEditorEnabled)
- document()->frame()->editor()->deleteButtonController()->disable();
- }
-
ExceptionCode ec = 0;
- for (Node* n = firstChild(); n && !ec; n = n->nextSibling())
+ for (Node* n = firstChild(); n && !ec; n = n->nextSibling()) {
+ if (n == deleteButtonContainerElement)
+ continue;
clone->appendChild(n->cloneNode(true), ec);
- if (isEditorEnabled && document()->frame())
- document()->frame()->editor()->deleteButtonController()->enable();
+ }
}
bool ContainerNode::getUpperLeftCorner(FloatPoint& point) const
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
