Diff
Modified: branches/safari-600.5-branch/LayoutTests/ChangeLog (179656 => 179657)
--- branches/safari-600.5-branch/LayoutTests/ChangeLog 2015-02-05 02:36:16 UTC (rev 179656)
+++ branches/safari-600.5-branch/LayoutTests/ChangeLog 2015-02-05 02:36:19 UTC (rev 179657)
@@ -1,3 +1,18 @@
+2015-02-03 Matthew Hanson <[email protected]>
+
+ Merge r178462. rdar://problem/19673708
+
+ 2015-01-14 Enrica Casucci <[email protected]>
+
+ REGRESSION (r165385): Crash when applying autocorrection exceeds maximum text area length.
+ https://bugs.webkit.org/show_bug.cgi?id=137902
+ rdar://problem/18568864
+
+ Reviewed by Darin Adler.
+
+ * editing/text-iterator/invalid-subrange-expected.txt: Added.
+ * editing/text-iterator/invalid-subrange.html: Added.
+
2015-02-04 Matthew Hanson <[email protected]>
Merge r176750. rdar://problem/19617755
Added: branches/safari-600.5-branch/LayoutTests/editing/text-iterator/invalid-subrange-expected.txt (0 => 179657)
--- branches/safari-600.5-branch/LayoutTests/editing/text-iterator/invalid-subrange-expected.txt (rev 0)
+++ branches/safari-600.5-branch/LayoutTests/editing/text-iterator/invalid-subrange-expected.txt 2015-02-05 02:36:19 UTC (rev 179657)
@@ -0,0 +1,6 @@
+PASS internals.lengthFromRange(container, subrange) is 0
+PASS internals.lengthFromRange(container, subrange) is 0
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: branches/safari-600.5-branch/LayoutTests/editing/text-iterator/invalid-subrange.html (0 => 179657)
--- branches/safari-600.5-branch/LayoutTests/editing/text-iterator/invalid-subrange.html (rev 0)
+++ branches/safari-600.5-branch/LayoutTests/editing/text-iterator/invalid-subrange.html 2015-02-05 02:36:19 UTC (rev 179657)
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<div id="test" contenteditable>
+<p>hello world.</p>
+</div>
+<div id="console"></div>
+<script>
+
+if (!window.internals)
+ testFailed('This test requires internals object');
+else {
+ var container = document.getElementById('test');
+
+ var p = document.querySelector('#test p');
+ var r = internals.rangeFromLocationAndLength(container, 0, 1);
+ // This offset is valid, the length is past the end of the range
+ var subrange = internals.subrange(r, 5, 100);
+ shouldBe('internals.lengthFromRange(container, subrange)', '0');
+ // This offset is past the end of the range
+ subrange = internals.subrange(r, 100, 1);
+ shouldBe('internals.lengthFromRange(container, subrange)', '0');
+ container.style.display = 'none';
+}
+
+
+</script>
+<script src=""
+</body>
+</html>
Modified: branches/safari-600.5-branch/Source/WebCore/ChangeLog (179656 => 179657)
--- branches/safari-600.5-branch/Source/WebCore/ChangeLog 2015-02-05 02:36:16 UTC (rev 179656)
+++ branches/safari-600.5-branch/Source/WebCore/ChangeLog 2015-02-05 02:36:19 UTC (rev 179657)
@@ -1,3 +1,29 @@
+2015-02-03 Matthew Hanson <[email protected]>
+
+ Merge r178462. rdar://problem/19673708
+
+ 2015-01-14 Enrica Casucci <[email protected]>
+
+ REGRESSION (r165385): Crash when applying autocorrection exceeds maximum text area length.
+ https://bugs.webkit.org/show_bug.cgi?id=137902
+ rdar://problem/18568864
+
+ Reviewed by Darin Adler.
+
+ Test: editing/text-iterator/invalid-subrange.html
+
+ characterSubrange should check the iterator position after each advance.
+ This changed adds a new method to the Internals object to be able to test this.
+
+ * editing/TextIterator.cpp:
+ (WebCore::characterSubrange):
+ (WebCore::TextIterator::subrange):
+ (WebCore::findPlainText):
+ * testing/Internals.cpp:
+ (WebCore::Internals::subrange):
+ * testing/Internals.h:
+ * testing/Internals.idl:
+
2015-02-04 Matthew Hanson <[email protected]>
Merge r176750. rdar://problem/19617755
Modified: branches/safari-600.5-branch/Source/WebCore/editing/TextIterator.cpp (179656 => 179657)
--- branches/safari-600.5-branch/Source/WebCore/editing/TextIterator.cpp 2015-02-05 02:36:16 UTC (rev 179656)
+++ branches/safari-600.5-branch/Source/WebCore/editing/TextIterator.cpp 2015-02-05 02:36:19 UTC (rev 179657)
@@ -1460,16 +1460,22 @@
m_runOffset = 0;
}
-static PassRefPtr<Range> characterSubrange(CharacterIterator& it, int offset, int length)
+static PassRefPtr<Range> characterSubrange(Document& document, CharacterIterator& it, int offset, int length)
{
it.advance(offset);
+ if (it.atEnd())
+ return Range::create(document);
+
RefPtr<Range> start = it.range();
if (length > 1)
it.advance(length - 1);
+ if (it.atEnd())
+ return Range::create(document);
+
RefPtr<Range> end = it.range();
- return Range::create(start->startContainer()->document(),
+ return Range::create(document,
start->startContainer(), start->startOffset(),
end->endContainer(), end->endOffset());
}
@@ -2379,7 +2385,7 @@
PassRefPtr<Range> TextIterator::subrange(Range* entireRange, int characterOffset, int characterCount)
{
CharacterIterator entireRangeIterator(*entireRange);
- return characterSubrange(entireRangeIterator, characterOffset, characterCount);
+ return characterSubrange(entireRange->ownerDocument(), entireRangeIterator, characterOffset, characterCount);
}
static inline bool isInsideReplacedElement(TextIterator& iterator)
@@ -2599,7 +2605,7 @@
// Then, find the document position of the start and the end of the text.
CharacterIterator computeRangeIterator(range, TextIteratorEntersTextControls);
- return characterSubrange(computeRangeIterator, matchStart, matchLength);
+ return characterSubrange(range.ownerDocument(), computeRangeIterator, matchStart, matchLength);
}
}
Modified: branches/safari-600.5-branch/Source/WebCore/testing/Internals.cpp (179656 => 179657)
--- branches/safari-600.5-branch/Source/WebCore/testing/Internals.cpp 2015-02-05 02:36:16 UTC (rev 179656)
+++ branches/safari-600.5-branch/Source/WebCore/testing/Internals.cpp 2015-02-05 02:36:19 UTC (rev 179657)
@@ -1054,6 +1054,16 @@
return range->text();
}
+PassRefPtr<Range> Internals::subrange(Range* range, int rangeLocation, int rangeLength, ExceptionCode& ec)
+{
+ if (!range) {
+ ec = INVALID_ACCESS_ERR;
+ return 0;
+ }
+
+ return TextIterator::subrange(range, rangeLocation, rangeLength);
+}
+
void Internals::setDelegatesScrolling(bool enabled, ExceptionCode& ec)
{
Document* document = contextDocument();
Modified: branches/safari-600.5-branch/Source/WebCore/testing/Internals.h (179656 => 179657)
--- branches/safari-600.5-branch/Source/WebCore/testing/Internals.h 2015-02-05 02:36:16 UTC (rev 179656)
+++ branches/safari-600.5-branch/Source/WebCore/testing/Internals.h 2015-02-05 02:36:19 UTC (rev 179657)
@@ -155,6 +155,7 @@
unsigned locationFromRange(Element* scope, const Range*, ExceptionCode&);
unsigned lengthFromRange(Element* scope, const Range*, ExceptionCode&);
String rangeAsText(const Range*, ExceptionCode&);
+ PassRefPtr<Range> subrange(Range* range, int rangeLocation, int rangeLength, ExceptionCode&);
void setDelegatesScrolling(bool enabled, ExceptionCode&);
Modified: branches/safari-600.5-branch/Source/WebCore/testing/Internals.idl (179656 => 179657)
--- branches/safari-600.5-branch/Source/WebCore/testing/Internals.idl 2015-02-05 02:36:16 UTC (rev 179656)
+++ branches/safari-600.5-branch/Source/WebCore/testing/Internals.idl 2015-02-05 02:36:19 UTC (rev 179657)
@@ -119,6 +119,7 @@
[RaisesException] unsigned long locationFromRange(Element scope, Range range);
[RaisesException] unsigned long lengthFromRange(Element scope, Range range);
[RaisesException] DOMString rangeAsText(Range range);
+ [RaisesException] Range subrange(Range range, long rangeLocation, long rangeLength);
[RaisesException] void setDelegatesScrolling(boolean enabled);
