Changeset 176732 in webkit

Timestamp:

Dec 3, 2014, 11:55:42 AM (12 years ago)

Author:

dburkart@apple.com

Message:

Merged r176295. rdar://problems/19122588

Location:

branches/safari-600.3-branch

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/block/selection-block-gap-crash-expected.txt (added)
• LayoutTests/fast/block/selection-block-gap-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/RenderBlock.cpp (modified) (1 diff)

branches/safari-600.3-branch/LayoutTests/ChangeLog

@@ +1 @@
+2014-12-03  Dana Burkart  <dburkart@apple.com>
+
+        Merge r176295. <rdar://problem/19122588>
+
+    2014-11-18  David Hyatt  <hyatt@apple.com>
+
+            REGRESSION (r167210): Invalid cast in WebCore::RenderBlock::blockSelectionGaps
+            https://bugs.webkit.org/show_bug.cgi?id=137590
+
+            Reviewed by Dean Jackson.
+
+            * fast/block/selection-block-gap-crash-expected.txt: Added.
+            * fast/block/selection-block-gap-crash.html: Added.
+
+
 2014-11-05  Simon Fraser  <simon.fraser@apple.com>
 

branches/safari-600.3-branch/Source/WebCore/ChangeLog

@@ +1 @@
+2014-12-03  Dana Burkart  <dburkart@apple.com>
+
+        Merge r176295. <rdar://problem/19122588>
+
+    2014-11-18  David Hyatt  <hyatt@apple.com>
+
+            REGRESSION (r167210): Invalid cast in WebCore::RenderBlock::blockSelectionGaps
+            https://bugs.webkit.org/show_bug.cgi?id=137590
+
+            Reviewed by Dean Jackson.
+
+            Added fast/block/selection-block-gaps-crash.html
+
+            * rendering/RenderBlock.cpp:
+            (WebCore::RenderBlock::blockSelectionGaps):
+            Check that we really are a RenderBlock before recurring.
+
+
 2014-12-03  Dana Burkart  <dburkart@apple.com>
 

branches/safari-600.3-branch/Source/WebCore/rendering/RenderBlock.cpp

@@ -2040 +2040 @@
             lastLogicalLeft = logicalLeftSelectionOffset(rootBlock, curr->logicalBottom(), cache);
             lastLogicalRight = logicalRightSelectionOffset(rootBlock, curr->logicalBottom(), cache);
-        } else if (childState != SelectionNone) {
+        } else if (childState != SelectionNone && is<RenderBlock>(*curr)) {
             // We must be a block that has some selected object inside it.  Go ahead and recur.
             result.unite(toRenderBlock(curr)->selectionGaps(rootBlock, rootBlockPhysicalPosition, LayoutSize(offsetFromRootBlock.width() + curr->x(), offsetFromRootBlock.height() + curr->y()),