Title: [136619] trunk/Source/WebCore
- Revision
- 136619
- Author
- [email protected]
- Date
- 2012-12-04 20:18:36 -0800 (Tue, 04 Dec 2012)
Log Message
Crash in WebCore::ApplyStyleCommand::pushDownInlineStyleAroundNode
https://bugs.webkit.org/show_bug.cgi?id=103515
Reviewed by Ryosuke Niwa.
|current| is weak node pointer that iterates in the hierarchy chain
between |highestAncestor| and |targetNode|. Script executed as part
of iframe onload event can blow away the nodes and we no longer have
|targetNode| in our descendants chain. So, we RefPtr |current| and bail
out when |targetNode| stops being a part of descendant chain.
Test blocked on https://bugs.webkit.org/show_bug.cgi?id=104044.
* editing/ApplyStyleCommand.cpp:
(WebCore::ApplyStyleCommand::pushDownInlineStyleAroundNode):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (136618 => 136619)
--- trunk/Source/WebCore/ChangeLog 2012-12-05 04:18:01 UTC (rev 136618)
+++ trunk/Source/WebCore/ChangeLog 2012-12-05 04:18:36 UTC (rev 136619)
@@ -1,3 +1,21 @@
+2012-12-04 Abhishek Arya <[email protected]>
+
+ Crash in WebCore::ApplyStyleCommand::pushDownInlineStyleAroundNode
+ https://bugs.webkit.org/show_bug.cgi?id=103515
+
+ Reviewed by Ryosuke Niwa.
+
+ |current| is weak node pointer that iterates in the hierarchy chain
+ between |highestAncestor| and |targetNode|. Script executed as part
+ of iframe onload event can blow away the nodes and we no longer have
+ |targetNode| in our descendants chain. So, we RefPtr |current| and bail
+ out when |targetNode| stops being a part of descendant chain.
+
+ Test blocked on https://bugs.webkit.org/show_bug.cgi?id=104044.
+
+ * editing/ApplyStyleCommand.cpp:
+ (WebCore::ApplyStyleCommand::pushDownInlineStyleAroundNode):
+
2012-12-04 Bruno de Oliveira Abinader <[email protected]>
Avoid repeated calls to decorationColor on RenderObject::getTextDecorationColors
Modified: trunk/Source/WebCore/editing/ApplyStyleCommand.cpp (136618 => 136619)
--- trunk/Source/WebCore/editing/ApplyStyleCommand.cpp 2012-12-05 04:18:01 UTC (rev 136618)
+++ trunk/Source/WebCore/editing/ApplyStyleCommand.cpp 2012-12-05 04:18:36 UTC (rev 136619)
@@ -976,24 +976,22 @@
return;
// The outer loop is traversing the tree vertically from highestAncestor to targetNode
- Node* current = highestAncestor;
+ RefPtr<Node> current = highestAncestor;
// Along the way, styled elements that contain targetNode are removed and accumulated into elementsToPushDown.
// Each child of the removed element, exclusing ancestors of targetNode, is then wrapped by clones of elements in elementsToPushDown.
Vector<RefPtr<Element> > elementsToPushDown;
- while (current != targetNode) {
- ASSERT(current);
- ASSERT(current->contains(targetNode));
+ while (current && current != targetNode && current->contains(targetNode)) {
NodeVector currentChildren;
- getChildNodes(current, currentChildren);
+ getChildNodes(current.get(), currentChildren);
RefPtr<StyledElement> styledElement;
- if (current->isStyledElement() && isStyledInlineElementToRemove(static_cast<Element*>(current))) {
- styledElement = static_cast<StyledElement*>(current);
+ if (current->isStyledElement() && isStyledInlineElementToRemove(static_cast<Element*>(current.get()))) {
+ styledElement = static_cast<StyledElement*>(current.get());
elementsToPushDown.append(styledElement);
}
RefPtr<EditingStyle> styleToPushDown = EditingStyle::create();
if (current->isHTMLElement())
- removeInlineStyleFromElement(style, toHTMLElement(current), RemoveIfNeeded, styleToPushDown.get());
+ removeInlineStyleFromElement(style, toHTMLElement(current.get()), RemoveIfNeeded, styleToPushDown.get());
// The inner loop will go through children on each level
// FIXME: we should aggregate inline child elements together so that we don't wrap each child separately.
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
