Title: [145619] branches/safari-536.30-branch
- Revision
- 145619
- Author
- [email protected]
- Date
- 2013-03-12 16:58:51 -0700 (Tue, 12 Mar 2013)
Log Message
Merged r135193. <rdar://problem/13335071>
Modified Paths
Added Paths
Diff
Modified: branches/safari-536.30-branch/LayoutTests/ChangeLog (145618 => 145619)
--- branches/safari-536.30-branch/LayoutTests/ChangeLog 2013-03-12 23:56:08 UTC (rev 145618)
+++ branches/safari-536.30-branch/LayoutTests/ChangeLog 2013-03-12 23:58:51 UTC (rev 145619)
@@ -1,5 +1,19 @@
2013-03-12 Lucas Forschler <[email protected]>
+ Merge r135193
+
+ 2012-11-19 Abhishek Arya <[email protected]>
+
+ Crash in ApplyStyleCommand::cleanupUnstyledAppleStyleSpans.
+ https://bugs.webkit.org/show_bug.cgi?id=100150
+
+ Reviewed by Ryosuke Niwa.
+
+ * editing/style/apply-style-crash-expected.txt: Added.
+ * editing/style/apply-style-crash.html: Added.
+
+2013-03-12 Lucas Forschler <[email protected]>
+
Merge r133717
2012-11-06 Ken Buchanan <[email protected]>
Copied: branches/safari-536.30-branch/LayoutTests/editing/style/apply-style-crash-expected.txt (from rev 135193, trunk/LayoutTests/editing/style/apply-style-crash-expected.txt) (0 => 145619)
--- branches/safari-536.30-branch/LayoutTests/editing/style/apply-style-crash-expected.txt (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/editing/style/apply-style-crash-expected.txt 2013-03-12 23:58:51 UTC (rev 145619)
@@ -0,0 +1 @@
+PASS. WebKit didn't crash.
Copied: branches/safari-536.30-branch/LayoutTests/editing/style/apply-style-crash.html (from rev 135193, trunk/LayoutTests/editing/style/apply-style-crash.html) (0 => 145619)
--- branches/safari-536.30-branch/LayoutTests/editing/style/apply-style-crash.html (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/editing/style/apply-style-crash.html 2013-03-12 23:58:51 UTC (rev 145619)
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<script>
+if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+}
+
+_onload_ = function() {
+ x.innerHTML += '';
+}
+
+setTimeout(function() {
+ document.designMode = 'on';
+ document.execCommand('selectall');
+ document.execCommand('bold');
+
+ document.body.offsetTop;
+ document.body.innerHTML = "PASS. WebKit didn't crash.";
+
+ if (window.testRunner)
+ testRunner.notifyDone();
+}, 0)
+</script>
+<div id="x"><iframe src=""
+<span><span><plaintext>
+
Modified: branches/safari-536.30-branch/Source/WebCore/ChangeLog (145618 => 145619)
--- branches/safari-536.30-branch/Source/WebCore/ChangeLog 2013-03-12 23:56:08 UTC (rev 145618)
+++ branches/safari-536.30-branch/Source/WebCore/ChangeLog 2013-03-12 23:58:51 UTC (rev 145619)
@@ -1,5 +1,24 @@
2013-03-12 Lucas Forschler <[email protected]>
+ Merge r135193
+
+ 2012-11-19 Abhishek Arya <[email protected]>
+
+ Crash in ApplyStyleCommand::cleanupUnstyledAppleStyleSpans.
+ https://bugs.webkit.org/show_bug.cgi?id=100150
+
+ Reviewed by Ryosuke Niwa.
+
+ RefPtr startDummySpanAncestor and endDummySpanAncestor since
+ they can go away inside fixRangeAndApplyInlineStyle call.
+
+ Test: editing/style/apply-style-crash.html
+
+ * editing/ApplyStyleCommand.cpp:
+ (WebCore::ApplyStyleCommand::applyInlineStyle):
+
+2013-03-12 Lucas Forschler <[email protected]>
+
Merge r133717
2012-11-06 Ken Buchanan <[email protected]>
Modified: branches/safari-536.30-branch/Source/WebCore/editing/ApplyStyleCommand.cpp (145618 => 145619)
--- branches/safari-536.30-branch/Source/WebCore/editing/ApplyStyleCommand.cpp 2013-03-12 23:56:08 UTC (rev 145618)
+++ branches/safari-536.30-branch/Source/WebCore/editing/ApplyStyleCommand.cpp 2013-03-12 23:58:51 UTC (rev 145619)
@@ -538,8 +538,8 @@
void ApplyStyleCommand::applyInlineStyle(EditingStyle* style)
{
- Node* startDummySpanAncestor = 0;
- Node* endDummySpanAncestor = 0;
+ RefPtr<Node> startDummySpanAncestor = 0;
+ RefPtr<Node> endDummySpanAncestor = 0;
// update document layout once before removing styles
// so that we avoid the expense of updating before each and every call
@@ -664,9 +664,9 @@
fixRangeAndApplyInlineStyle(styleToApply.get(), start, end);
// Remove dummy style spans created by splitting text elements.
- cleanupUnstyledAppleStyleSpans(startDummySpanAncestor);
+ cleanupUnstyledAppleStyleSpans(startDummySpanAncestor.get());
if (endDummySpanAncestor != startDummySpanAncestor)
- cleanupUnstyledAppleStyleSpans(endDummySpanAncestor);
+ cleanupUnstyledAppleStyleSpans(endDummySpanAncestor.get());
}
void ApplyStyleCommand::fixRangeAndApplyInlineStyle(EditingStyle* style, const Position& start, const Position& end)
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
