Title: [136268] branches/chromium/1271
- Revision
- 136268
- Author
- [email protected]
- Date
- 2012-11-30 13:26:26 -0800 (Fri, 30 Nov 2012)
Log Message
Merge 135193
BUG=156619
Review URL: https://codereview.chromium.org/11418269
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1271/LayoutTests/editing/style/apply-style-crash-expected.txt (from rev 135193, trunk/LayoutTests/editing/style/apply-style-crash-expected.txt) (0 => 136268)
--- branches/chromium/1271/LayoutTests/editing/style/apply-style-crash-expected.txt (rev 0)
+++ branches/chromium/1271/LayoutTests/editing/style/apply-style-crash-expected.txt 2012-11-30 21:26:26 UTC (rev 136268)
@@ -0,0 +1 @@
+PASS. WebKit didn't crash.
Copied: branches/chromium/1271/LayoutTests/editing/style/apply-style-crash.html (from rev 135193, trunk/LayoutTests/editing/style/apply-style-crash.html) (0 => 136268)
--- branches/chromium/1271/LayoutTests/editing/style/apply-style-crash.html (rev 0)
+++ branches/chromium/1271/LayoutTests/editing/style/apply-style-crash.html 2012-11-30 21:26:26 UTC (rev 136268)
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<script>
+if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+}
+
+_onload_ = function() {
+ x.innerHTML += '';
+}
+
+setTimeout(function() {
+ document.designMode = 'on';
+ document.execCommand('selectall');
+ document.execCommand('bold');
+
+ document.body.offsetTop;
+ document.body.innerHTML = "PASS. WebKit didn't crash.";
+
+ if (window.testRunner)
+ testRunner.notifyDone();
+}, 0)
+</script>
+<div id="x"><iframe src=""
+<span><span><plaintext>
+
Modified: branches/chromium/1271/Source/WebCore/editing/ApplyStyleCommand.cpp (136267 => 136268)
--- branches/chromium/1271/Source/WebCore/editing/ApplyStyleCommand.cpp 2012-11-30 21:25:57 UTC (rev 136267)
+++ branches/chromium/1271/Source/WebCore/editing/ApplyStyleCommand.cpp 2012-11-30 21:26:26 UTC (rev 136268)
@@ -539,8 +539,8 @@
void ApplyStyleCommand::applyInlineStyle(EditingStyle* style)
{
- Node* startDummySpanAncestor = 0;
- Node* endDummySpanAncestor = 0;
+ RefPtr<Node> startDummySpanAncestor = 0;
+ RefPtr<Node> endDummySpanAncestor = 0;
// update document layout once before removing styles
// so that we avoid the expense of updating before each and every call
@@ -665,9 +665,9 @@
fixRangeAndApplyInlineStyle(styleToApply.get(), start, end);
// Remove dummy style spans created by splitting text elements.
- cleanupUnstyledAppleStyleSpans(startDummySpanAncestor);
+ cleanupUnstyledAppleStyleSpans(startDummySpanAncestor.get());
if (endDummySpanAncestor != startDummySpanAncestor)
- cleanupUnstyledAppleStyleSpans(endDummySpanAncestor);
+ cleanupUnstyledAppleStyleSpans(endDummySpanAncestor.get());
}
void ApplyStyleCommand::fixRangeAndApplyInlineStyle(EditingStyle* style, const Position& start, const Position& end)
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
