Title: [176295] trunk
- Revision
- 176295
- Author
- [email protected]
- Date
- 2014-11-18 16:37:35 -0800 (Tue, 18 Nov 2014)
Log Message
REGRESSION (r167210): Invalid cast in WebCore::RenderBlock::blockSelectionGaps
https://bugs.webkit.org/show_bug.cgi?id=137590
Reviewed by Dean Jackson.
Source/WebCore:
Added fast/block/selection-block-gaps-crash.html
* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::blockSelectionGaps):
Check that we really are a RenderBlock before recurring.
LayoutTests:
* fast/block/selection-block-gap-crash-expected.txt: Added.
* fast/block/selection-block-gap-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (176294 => 176295)
--- trunk/LayoutTests/ChangeLog 2014-11-19 00:20:07 UTC (rev 176294)
+++ trunk/LayoutTests/ChangeLog 2014-11-19 00:37:35 UTC (rev 176295)
@@ -1,3 +1,13 @@
+2014-11-18 David Hyatt <[email protected]>
+
+ REGRESSION (r167210): Invalid cast in WebCore::RenderBlock::blockSelectionGaps
+ https://bugs.webkit.org/show_bug.cgi?id=137590
+
+ Reviewed by Dean Jackson.
+
+ * fast/block/selection-block-gap-crash-expected.txt: Added.
+ * fast/block/selection-block-gap-crash.html: Added.
+
2014-11-18 Andreas Kling <[email protected]>
Avoid synchronous style recalc in Document.activeElement
Added: trunk/LayoutTests/fast/block/selection-block-gap-crash-expected.txt (0 => 176295)
--- trunk/LayoutTests/fast/block/selection-block-gap-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/block/selection-block-gap-crash-expected.txt 2014-11-19 00:37:35 UTC (rev 176295)
@@ -0,0 +1 @@
+This test passes if it doesn't crash.
Added: trunk/LayoutTests/fast/block/selection-block-gap-crash.html (0 => 176295)
--- trunk/LayoutTests/fast/block/selection-block-gap-crash.html (rev 0)
+++ trunk/LayoutTests/fast/block/selection-block-gap-crash.html 2014-11-19 00:37:35 UTC (rev 176295)
@@ -0,0 +1,11 @@
+This test passes if it doesn't crash.
+<div role="img" id="div"></div>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText()
+var elem = document.getElementById("div"); var parent = elem.parentNode;
+new_elem = document.createElement("frameset");
+new_elem.setAttribute("role", "img");
+parent.insertBefore(new_elem, elem);
+document.execCommand("SelectAll");
+</script>
Modified: trunk/Source/WebCore/ChangeLog (176294 => 176295)
--- trunk/Source/WebCore/ChangeLog 2014-11-19 00:20:07 UTC (rev 176294)
+++ trunk/Source/WebCore/ChangeLog 2014-11-19 00:37:35 UTC (rev 176295)
@@ -1,3 +1,16 @@
+2014-11-18 David Hyatt <[email protected]>
+
+ REGRESSION (r167210): Invalid cast in WebCore::RenderBlock::blockSelectionGaps
+ https://bugs.webkit.org/show_bug.cgi?id=137590
+
+ Reviewed by Dean Jackson.
+
+ Added fast/block/selection-block-gaps-crash.html
+
+ * rendering/RenderBlock.cpp:
+ (WebCore::RenderBlock::blockSelectionGaps):
+ Check that we really are a RenderBlock before recurring.
+
2014-11-18 Andreas Kling <[email protected]>
Avoid synchronous style recalc in Document.activeElement
Modified: trunk/Source/WebCore/rendering/RenderBlock.cpp (176294 => 176295)
--- trunk/Source/WebCore/rendering/RenderBlock.cpp 2014-11-19 00:20:07 UTC (rev 176294)
+++ trunk/Source/WebCore/rendering/RenderBlock.cpp 2014-11-19 00:37:35 UTC (rev 176295)
@@ -1956,7 +1956,7 @@
lastLogicalTop = blockDirectionOffset(rootBlock, offsetFromRootBlock) + curr->logicalBottom();
lastLogicalLeft = logicalLeftSelectionOffset(rootBlock, curr->logicalBottom(), cache);
lastLogicalRight = logicalRightSelectionOffset(rootBlock, curr->logicalBottom(), cache);
- } else if (childState != SelectionNone) {
+ } else if (childState != SelectionNone && is<RenderBlock>(*curr)) {
// We must be a block that has some selected object inside it. Go ahead and recur.
result.unite(downcast<RenderBlock>(*curr).selectionGaps(rootBlock, rootBlockPhysicalPosition, LayoutSize(offsetFromRootBlock.width() + curr->x(), offsetFromRootBlock.height() + curr->y()),
lastLogicalTop, lastLogicalLeft, lastLogicalRight, childCache, paintInfo));
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
