Title: [186457] releases/WebKitGTK/webkit-2.8
Revision
186457
Author
[email protected]
Date
2015-07-07 05:33:54 -0700 (Tue, 07 Jul 2015)

Log Message

Merge r186393 - Crash when setting text direction via MakeTextWritingDirection* editing commands.
<https://webkit.org/b/146665>
<rdar://problem/20835477>

Reviewed by Ryosuke Niwa.

Source/WebCore:

Fix two buggy clients of enclosingBlock(node) that would fail if the returned
element is the same as the node passed in.

Test: editing/style/change-text-direction-crash.html

* editing/ApplyStyleCommand.cpp:
(WebCore::ApplyStyleCommand::splitAncestorsWithUnicodeBidi):
(WebCore::ApplyStyleCommand::removeEmbeddingUpToEnclosingBlock):

LayoutTests:

Add a test that covers some very simple MakeTextWritingDirection* command usage.

* editing/style/change-text-direction-crash-expected.txt: Added.
* editing/style/change-text-direction-crash.html: Added.

Modified Paths

Added Paths

Diff

Modified: releases/WebKitGTK/webkit-2.8/LayoutTests/ChangeLog (186456 => 186457)


--- releases/WebKitGTK/webkit-2.8/LayoutTests/ChangeLog	2015-07-07 12:30:57 UTC (rev 186456)
+++ releases/WebKitGTK/webkit-2.8/LayoutTests/ChangeLog	2015-07-07 12:33:54 UTC (rev 186457)
@@ -1,3 +1,16 @@
+2015-07-06  Andreas Kling  <[email protected]>
+
+        Crash when setting text direction via MakeTextWritingDirection* editing commands.
+        <https://webkit.org/b/146665>
+        <rdar://problem/20835477>
+
+        Reviewed by Ryosuke Niwa.
+
+        Add a test that covers some very simple MakeTextWritingDirection* command usage.
+
+        * editing/style/change-text-direction-crash-expected.txt: Added.
+        * editing/style/change-text-direction-crash.html: Added.
+
 2015-07-03  Chris Dumez  <[email protected]>
 
         REGRESSION (r178097): HTMLSelectElement.add(option, undefined) prepends option to the list of options; should append to the end of the list of options

Added: releases/WebKitGTK/webkit-2.8/LayoutTests/editing/style/change-text-direction-crash-expected.txt (0 => 186457)


--- releases/WebKitGTK/webkit-2.8/LayoutTests/editing/style/change-text-direction-crash-expected.txt	                        (rev 0)
+++ releases/WebKitGTK/webkit-2.8/LayoutTests/editing/style/change-text-direction-crash-expected.txt	2015-07-07 12:33:54 UTC (rev 186457)
@@ -0,0 +1,33 @@
+This test verifies that programmatically setting the text direction using editing commands doesn't crash.
+
+MakeTextWritingDirectionLeftToRight:
+| "foo"
+| <div>
+|   <span>
+|     id="bar"
+|     style="unicode-bidi: embed;"
+|     "<#selection-anchor>aתbc"
+| <div>
+|   <#selection-focus>
+|   "baz"
+
+MakeTextWritingDirectionRightToLeft:
+| "foo"
+| <div>
+|   <span>
+|     id="bar"
+|     style="unicode-bidi: embed; direction: rtl;"
+|     "<#selection-anchor>aתbc"
+| <div>
+|   <#selection-focus>
+|   "baz"
+
+MakeTextWritingDirectionNatural:
+| "foo"
+| <div>
+|   <span>
+|     id="bar"
+|     "<#selection-anchor>aתbc"
+| <div>
+|   <#selection-focus>
+|   "baz"

Added: releases/WebKitGTK/webkit-2.8/LayoutTests/editing/style/change-text-direction-crash.html (0 => 186457)


--- releases/WebKitGTK/webkit-2.8/LayoutTests/editing/style/change-text-direction-crash.html	                        (rev 0)
+++ releases/WebKitGTK/webkit-2.8/LayoutTests/editing/style/change-text-direction-crash.html	2015-07-07 12:33:54 UTC (rev 186457)
@@ -0,0 +1,27 @@
+<html>
+<script src=""
+<body>
+</body>
+<script>
+Markup.description("This test verifies that programmatically setting the text direction using editing commands doesn't crash.");
+
+function testCommand(command) {
+    document.body.innerHTML = '<div id="foo" contenteditable>foo<div><span id="bar">aתbc</span></div><div>baz</div></div>';
+
+    var range = document.createRange();
+    var barSpan = document.getElementById("bar");
+    range.setStartBefore(barSpan);
+    range.setEndAfter(barSpan.parentNode)
+    var sel = window.getSelection();
+    sel.removeAllRanges();
+    sel.addRange(range);
+
+    window.testRunner.execCommand(command, false, true);
+    Markup.dump("foo", command);
+}
+
+testCommand("MakeTextWritingDirectionLeftToRight");
+testCommand("MakeTextWritingDirectionRightToLeft");
+testCommand("MakeTextWritingDirectionNatural");
+</script>
+</html>

Modified: releases/WebKitGTK/webkit-2.8/Source/WebCore/ChangeLog (186456 => 186457)


--- releases/WebKitGTK/webkit-2.8/Source/WebCore/ChangeLog	2015-07-07 12:30:57 UTC (rev 186456)
+++ releases/WebKitGTK/webkit-2.8/Source/WebCore/ChangeLog	2015-07-07 12:33:54 UTC (rev 186457)
@@ -1,3 +1,20 @@
+2015-07-06  Andreas Kling  <[email protected]>
+
+        Crash when setting text direction via MakeTextWritingDirection* editing commands.
+        <https://webkit.org/b/146665>
+        <rdar://problem/20835477>
+
+        Reviewed by Ryosuke Niwa.
+
+        Fix two buggy clients of enclosingBlock(node) that would fail if the returned
+        element is the same as the node passed in.
+
+        Test: editing/style/change-text-direction-crash.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::splitAncestorsWithUnicodeBidi):
+        (WebCore::ApplyStyleCommand::removeEmbeddingUpToEnclosingBlock):
+
 2015-07-06  Dean Jackson  <[email protected]>
 
         Memory corruption in WebGLRenderingContext::simulateVertexAttrib0

Modified: releases/WebKitGTK/webkit-2.8/Source/WebCore/editing/ApplyStyleCommand.cpp (186456 => 186457)


--- releases/WebKitGTK/webkit-2.8/Source/WebCore/editing/ApplyStyleCommand.cpp	2015-07-07 12:30:57 UTC (rev 186456)
+++ releases/WebKitGTK/webkit-2.8/Source/WebCore/editing/ApplyStyleCommand.cpp	2015-07-07 12:33:54 UTC (rev 186457)
@@ -452,8 +452,8 @@
 {
     // We are allowed to leave the highest ancestor with unicode-bidi unsplit if it is unicode-bidi: embed and direction: allowedDirection.
     // In that case, we return the unsplit ancestor. Otherwise, we return 0.
-    Node* block = enclosingBlock(node);
-    if (!block)
+    Element* block = enclosingBlock(node);
+    if (!block || block == node)
         return 0;
 
     Node* highestAncestorWithUnicodeBidi = 0;
@@ -501,8 +501,8 @@
 
 void ApplyStyleCommand::removeEmbeddingUpToEnclosingBlock(Node* node, Node* unsplitAncestor)
 {
-    Node* block = enclosingBlock(node);
-    if (!block)
+    Element* block = enclosingBlock(node);
+    if (!block || block == node)
         return;
 
     Node* parent = nullptr;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to