Title: [164170] trunk
- Revision
- 164170
- Author
- [email protected]
- Date
- 2014-02-15 00:57:21 -0800 (Sat, 15 Feb 2014)
Log Message
ASSERT_WITH_SECURITY_IMPLICATION in WebCore::toElement
https://bugs.webkit.org/show_bug.cgi?id=128810
Patch by Renata Hodovan <[email protected]> on 2014-02-15
Reviewed by Ryosuke Niwa.
Source/WebCore:
Make CompositeEditCommand::cloneParagraphUnderNewElement() to work when |outerNode|
doesn't contain |start|.
Before this patch, CompositeEditCommand::cloneParagraphUnderNewElement() tried to copy
ancestry nodes from |start| to Document node when |start| position isn't in |outerNode|. This
patch changes CompositeEditCommand::cloneParagraphUnderNewElement() to copy |start| to
|outerNode| only if |outerNode| contains |start| position.
Merged from Blink https://src.chromium.org/viewvc/blink?revision=161762&view=revision by [email protected].
Test: editing/execCommand/indent-with-uneditable-crash.html
* editing/CompositeEditCommand.cpp:
(WebCore::CompositeEditCommand::cloneParagraphUnderNewElement):
LayoutTests:
* editing/execCommand/indent-with-uneditable-crash-expected.txt: Added.
* editing/execCommand/indent-with-uneditable-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (164169 => 164170)
--- trunk/LayoutTests/ChangeLog 2014-02-15 08:39:32 UTC (rev 164169)
+++ trunk/LayoutTests/ChangeLog 2014-02-15 08:57:21 UTC (rev 164170)
@@ -1,3 +1,13 @@
+2014-02-15 Renata Hodovan <[email protected]>
+
+ ASSERT_WITH_SECURITY_IMPLICATION in WebCore::toElement
+ https://bugs.webkit.org/show_bug.cgi?id=128810
+
+ Reviewed by Ryosuke Niwa.
+
+ * editing/execCommand/indent-with-uneditable-crash-expected.txt: Added.
+ * editing/execCommand/indent-with-uneditable-crash.html: Added.
+
2014-02-15 Samuel White <[email protected]>
AX: Add ability to specify descendant type when using AXUIElementsForSearchPredicate.
Added: trunk/LayoutTests/editing/execCommand/indent-with-uneditable-crash-expected.txt (0 => 164170)
--- trunk/LayoutTests/editing/execCommand/indent-with-uneditable-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/editing/execCommand/indent-with-uneditable-crash-expected.txt 2014-02-15 08:57:21 UTC (rev 164170)
@@ -0,0 +1 @@
+Test passes if it does not crash.
Added: trunk/LayoutTests/editing/execCommand/indent-with-uneditable-crash.html (0 => 164170)
--- trunk/LayoutTests/editing/execCommand/indent-with-uneditable-crash.html (rev 0)
+++ trunk/LayoutTests/editing/execCommand/indent-with-uneditable-crash.html 2014-02-15 08:57:21 UTC (rev 164170)
@@ -0,0 +1,15 @@
+<body contenteditable="true">
+ <select></select>
+ <form>
+ <i contenteditable="false"></i>
+ <dfn></dfn></form><hr>
+
+ <script type="text/_javascript_">
+ if (window.testRunner)
+ testRunner.dumpAsText();
+
+ document.execCommand("selectall");
+ document.execCommand("indent");
+ document.body.innerHTML = "Test passes if it does not crash.";
+ </script>
+</body>
Modified: trunk/Source/WebCore/ChangeLog (164169 => 164170)
--- trunk/Source/WebCore/ChangeLog 2014-02-15 08:39:32 UTC (rev 164169)
+++ trunk/Source/WebCore/ChangeLog 2014-02-15 08:57:21 UTC (rev 164170)
@@ -1,3 +1,25 @@
+2014-02-15 Renata Hodovan <[email protected]>
+
+ ASSERT_WITH_SECURITY_IMPLICATION in WebCore::toElement
+ https://bugs.webkit.org/show_bug.cgi?id=128810
+
+ Reviewed by Ryosuke Niwa.
+
+ Make CompositeEditCommand::cloneParagraphUnderNewElement() to work when |outerNode|
+ doesn't contain |start|.
+
+ Before this patch, CompositeEditCommand::cloneParagraphUnderNewElement() tried to copy
+ ancestry nodes from |start| to Document node when |start| position isn't in |outerNode|. This
+ patch changes CompositeEditCommand::cloneParagraphUnderNewElement() to copy |start| to
+ |outerNode| only if |outerNode| contains |start| position.
+
+ Merged from Blink https://src.chromium.org/viewvc/blink?revision=161762&view=revision by [email protected].
+
+ Test: editing/execCommand/indent-with-uneditable-crash.html
+
+ * editing/CompositeEditCommand.cpp:
+ (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement):
+
2014-02-15 Samuel White <[email protected]>
AX: Add ability to specify descendant type when using AXUIElementsForSearchPredicate.
Modified: trunk/Source/WebCore/editing/CompositeEditCommand.cpp (164169 => 164170)
--- trunk/Source/WebCore/editing/CompositeEditCommand.cpp 2014-02-15 08:39:32 UTC (rev 164169)
+++ trunk/Source/WebCore/editing/CompositeEditCommand.cpp 2014-02-15 08:57:21 UTC (rev 164170)
@@ -1061,7 +1061,7 @@
appendNode(lastNode, blockElement);
}
- if (start.deprecatedNode() != outerNode && lastNode->isElementNode()) {
+ if (start.deprecatedNode() != outerNode && lastNode->isElementNode() && start.anchorNode()->isDescendantOf(outerNode.get())) {
Vector<RefPtr<Node>> ancestors;
// Insert each node from innerNode to outerNode (excluded) in a list.
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
