Title: [163900] branches/safari-537.75-branch/Source/WebCore
Diff
Modified: branches/safari-537.75-branch/Source/WebCore/ChangeLog (163899 => 163900)
--- branches/safari-537.75-branch/Source/WebCore/ChangeLog 2014-02-11 20:44:03 UTC (rev 163899)
+++ branches/safari-537.75-branch/Source/WebCore/ChangeLog 2014-02-11 21:01:20 UTC (rev 163900)
@@ -1,5 +1,22 @@
2014-02-11 Matthew Hanson <[email protected]>
+ Merge r158719.
+
+ 2013-11-05 Ryosuke Niwa <[email protected]>
+
+ Protect DOM nodes in IndentOutdentCommand::tryIndentingAsListItem()
+ https://bugs.webkit.org/show_bug.cgi?id=123861
+
+ Reviewed by Benjamin Poulain.
+
+ Merge https://chromium.googlesource.com/chromium/blink/+/297442eb539a2b764fdad323de79099a70179186 partially.
+
+ * editing/IndentOutdentCommand.cpp:
+ (WebCore::IndentOutdentCommand::tryIndentingAsListItem): Make selectedListItem, previousList, and nextList
+ RefPtr since they're are used after calling insertNodeBefore.
+
+2014-02-11 Matthew Hanson <[email protected]>
+
Merge r158058.
2013-10-25 Mark Lam <[email protected]>
Modified: branches/safari-537.75-branch/Source/WebCore/editing/IndentOutdentCommand.cpp (163899 => 163900)
--- branches/safari-537.75-branch/Source/WebCore/editing/IndentOutdentCommand.cpp 2014-02-11 20:44:03 UTC (rev 163899)
+++ branches/safari-537.75-branch/Source/WebCore/editing/IndentOutdentCommand.cpp 2014-02-11 21:01:20 UTC (rev 163900)
@@ -65,24 +65,24 @@
return false;
// Find the block that we want to indent. If it's not a list item (e.g., a div inside a list item), we bail out.
- Element* selectedListItem = enclosingBlock(lastNodeInSelectedParagraph);
+ RefPtr<Element> selectedListItem = enclosingBlock(lastNodeInSelectedParagraph);
// FIXME: we need to deal with the case where there is no li (malformed HTML)
if (!selectedListItem->hasTagName(liTag))
return false;
// FIXME: previousElementSibling does not ignore non-rendered content like <span></span>. Should we?
- Element* previousList = selectedListItem->previousElementSibling();
- Element* nextList = selectedListItem->nextElementSibling();
-
+ RefPtr<Element> previousList = selectedListItem->previousElementSibling();
+ RefPtr<Element> nextList = selectedListItem->nextElementSibling();
+
RefPtr<Element> newList = document()->createElement(listNode->tagQName(), false);
insertNodeBefore(newList, selectedListItem);
- moveParagraphWithClones(start, end, newList.get(), selectedListItem);
+ moveParagraphWithClones(start, end, newList.get(), selectedListItem.get());
- if (canMergeLists(previousList, newList.get()))
+ if (canMergeLists(previousList.get(), newList.get()))
mergeIdenticalElements(previousList, newList);
- if (canMergeLists(newList.get(), nextList))
+ if (canMergeLists(newList.get(), nextList.get()))
mergeIdenticalElements(newList, nextList);
return true;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
