⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 201823 in webkit


Ignore:
Timestamp:
Jun 8, 2016, 12:19:22 PM (10 years ago)
Author:
rniwa@webkit.org
Message:
REGRESSION (r201667): ASSERTION FAILED: !m_anchorNode
!editingIgnoresContent(*m_anchorNode)

​https://bugs.webkit.org/show_bug.cgi?id=158373
Source/WebCore:

<rdar://problem/26690795>

Reviewed by Brent Fulgham.

The bug was caused by VisibleSelection::toNormalizedRange calling parentAnchoredEquivalent on an orphaned Position.
Fixed it by checking that condition and exiting early since we can't create a Range with a detached node anyway.

Also renamed isNonOrphanedCaretOrRange to isNoneOrOrphaned after negating the semantics for clarity.

Test: editing/selection/selection-in-iframe-removed-crash.html

  • editing/EditorCommand.cpp:

(WebCore::valueFormatBlock):

  • editing/FrameSelection.cpp:

(WebCore::FrameSelection::setSelectionWithoutUpdatingAppearance):

  • editing/InsertLineBreakCommand.cpp:

(WebCore::InsertLineBreakCommand::doApply):

  • editing/InsertListCommand.cpp:

(WebCore::InsertListCommand::doApply):

  • editing/InsertParagraphSeparatorCommand.cpp:

(WebCore::InsertParagraphSeparatorCommand::doApply):

  • editing/InsertTextCommand.cpp:

(WebCore::InsertTextCommand::doApply):

  • editing/RemoveFormatCommand.cpp:

(WebCore::RemoveFormatCommand::doApply):

  • editing/ReplaceSelectionCommand.cpp:

(WebCore::ReplaceSelectionCommand::doApply):

  • editing/SetSelectionCommand.cpp:

(WebCore::SetSelectionCommand::doApply):
(WebCore::SetSelectionCommand::doUnapply):

  • editing/TypingCommand.cpp:

(WebCore::TypingCommand::doApply):

  • editing/VisibleSelection.cpp:

(WebCore::VisibleSelection::firstRange): Also added a check for isNoneOrOrphaned since this function can hit the same
assertion when the selection end points are orphaned.
(WebCore::VisibleSelection::toNormalizedRange): Fixed the bug.

  • editing/VisibleSelection.h:

(WebCore::VisibleSelection::isNoneOrOrphaned): Renamed from isNonOrphanedCaretOrRange and negated the semantics.

LayoutTests:

Reviewed by Brent Fulgham.

Fixed a test so that the assertion failure happens within the test instead of affecting the subsequent test.

  • editing/selection/selection-in-iframe-removed-crash-expected.txt:
  • editing/selection/selection-in-iframe-removed-crash.html:
Location:
trunk
Files:
16 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r201820 r201823  
     12016-06-07  Ryosuke Niwa  <rniwa@webkit.org>
     2
     3        REGRESSION (r201667): ASSERTION FAILED: !m_anchorNode || !editingIgnoresContent(*m_anchorNode)
     4        https://bugs.webkit.org/show_bug.cgi?id=158373
     5
     6        Reviewed by Brent Fulgham.
     7
     8        Fixed a test so that the assertion failure happens within the test instead of affecting the subsequent test.
     9
     10        * editing/selection/selection-in-iframe-removed-crash-expected.txt:
     11        * editing/selection/selection-in-iframe-removed-crash.html:
     12
    1132016-06-08  Ryan Haddad  <ryanhaddad@apple.com>
    214

  • trunk/LayoutTests/editing/selection/selection-in-iframe-removed-crash-expected.txt

    r144400 r201823  
    1 Test passes if it does not crash. 
     1Test passes if it does not crash.

  • trunk/LayoutTests/editing/selection/selection-in-iframe-removed-crash.html

    r144400 r201823  
    33Test passes if it does not crash.
    44<script>
    5 if (window.testRunner)
     5if (window.testRunner) {
    66    testRunner.dumpAsText();
     7    testRunner.waitUntilDone();
     8}
    79
    810var docElement = document.documentElement;
    … …  
    2224    range1.selectNodeContents(iframe1.contentDocument);
    2325    window.getSelection().addRange(range1);
     26    if (window.testRunner)
     27        testRunner.notifyDone();
    2428}
    2529

  • trunk/Source/WebCore/ChangeLog

    r201818 r201823  
     12016-06-07  Ryosuke Niwa  <rniwa@webkit.org>
     2
     3        REGRESSION (r201667): ASSERTION FAILED: !m_anchorNode || !editingIgnoresContent(*m_anchorNode)
     4        https://bugs.webkit.org/show_bug.cgi?id=158373
     5        <rdar://problem/26690795>
     6
     7        Reviewed by Brent Fulgham.
     8
     9        The bug was caused by VisibleSelection::toNormalizedRange calling parentAnchoredEquivalent on an orphaned Position.
     10        Fixed it by checking that condition and exiting early since we can't create a Range with a detached node anyway.
     11
     12        Also renamed isNonOrphanedCaretOrRange to isNoneOrOrphaned after negating the semantics for clarity.
     13
     14        Test: editing/selection/selection-in-iframe-removed-crash.html
     15
     16        * editing/EditorCommand.cpp:
     17        (WebCore::valueFormatBlock):
     18        * editing/FrameSelection.cpp:
     19        (WebCore::FrameSelection::setSelectionWithoutUpdatingAppearance):
     20        * editing/InsertLineBreakCommand.cpp:
     21        (WebCore::InsertLineBreakCommand::doApply):
     22        * editing/InsertListCommand.cpp:
     23        (WebCore::InsertListCommand::doApply):
     24        * editing/InsertParagraphSeparatorCommand.cpp:
     25        (WebCore::InsertParagraphSeparatorCommand::doApply):
     26        * editing/InsertTextCommand.cpp:
     27        (WebCore::InsertTextCommand::doApply):
     28        * editing/RemoveFormatCommand.cpp:
     29        (WebCore::RemoveFormatCommand::doApply):
     30        * editing/ReplaceSelectionCommand.cpp:
     31        (WebCore::ReplaceSelectionCommand::doApply):
     32        * editing/SetSelectionCommand.cpp:
     33        (WebCore::SetSelectionCommand::doApply):
     34        (WebCore::SetSelectionCommand::doUnapply):
     35        * editing/TypingCommand.cpp:
     36        (WebCore::TypingCommand::doApply):
     37        * editing/VisibleSelection.cpp:
     38        (WebCore::VisibleSelection::firstRange): Also added a check for isNoneOrOrphaned since this function can hit the same
     39        assertion when the selection end points are orphaned.
     40        (WebCore::VisibleSelection::toNormalizedRange): Fixed the bug.
     41        * editing/VisibleSelection.h:
     42        (WebCore::VisibleSelection::isNoneOrOrphaned): Renamed from isNonOrphanedCaretOrRange and negated the semantics.
     43
    1442016-06-08  Dean Jackson  <dino@apple.com>
    245

  • trunk/Source/WebCore/editing/EditorCommand.cpp

    r200696 r201823  
    14851485{
    14861486    const VisibleSelection& selection = frame.selection().selection();
    1487     if (!selection.isNonOrphanedCaretOrRange() || !selection.isContentEditable())
     1487    if (selection.isNoneOrOrphaned() || !selection.isContentEditable())
    14881488        return emptyString();
    14891489    Element* formatBlockElement = FormatBlockCommand::elementForFormatBlockCommand(selection.firstRange().get());

  • trunk/Source/WebCore/editing/FrameSelection.cpp

    r201205 r201823  
    291291                // selectFrameElementInParentIfFullySelected, but that the selection is no longer valid since
    292292                // the frame is about to be destroyed. If this is the case, clear our selection.
    293                 if (newSelectionFrame->hasOneRef() && !m_selection.isNonOrphanedCaretOrRange())
     293                if (newSelectionFrame->hasOneRef() && m_selection.isNoneOrOrphaned())
    294294                    clear();
    295295                return false;

  • trunk/Source/WebCore/editing/InsertLineBreakCommand.cpp

    r200922 r201823  
    9292    deleteSelection();
    9393    VisibleSelection selection = endingSelection();
    94     if (!selection.isNonOrphanedCaretOrRange())
     94    if (selection.isNoneOrOrphaned())
    9595        return;
    9696   

  • trunk/Source/WebCore/editing/InsertListCommand.cpp

    r200922 r201823  
    113113void InsertListCommand::doApply()
    114114{
    115     if (!endingSelection().isNonOrphanedCaretOrRange())
     115    if (endingSelection().isNoneOrOrphaned() || !endingSelection().isContentRichlyEditable())
    116116        return;
    117117
    118     if (!endingSelection().rootEditableElement())
    119         return;
    120    
    121118    VisiblePosition visibleEnd = endingSelection().visibleEnd();
    122119    VisiblePosition visibleStart = endingSelection().visibleStart();

  • trunk/Source/WebCore/editing/InsertParagraphSeparatorCommand.cpp

    r200931 r201823  
    149149void InsertParagraphSeparatorCommand::doApply()
    150150{
    151     if (!endingSelection().isNonOrphanedCaretOrRange())
     151    if (endingSelection().isNoneOrOrphaned())
    152152        return;
    153153   

  • trunk/Source/WebCore/editing/InsertTextCommand.cpp

    r200922 r201823  
    133133    ASSERT(m_text.find('\n') == notFound);
    134134
    135     if (!endingSelection().isNonOrphanedCaretOrRange())
     135    if (endingSelection().isNoneOrOrphaned())
    136136        return;
    137137

  • trunk/Source/WebCore/editing/RemoveFormatCommand.cpp

    r166294 r201823  
    7979void RemoveFormatCommand::doApply()
    8080{
    81     if (!endingSelection().isNonOrphanedCaretOrRange())
     81    if (endingSelection().isNoneOrOrphaned())
    8282        return;
    8383

  • trunk/Source/WebCore/editing/ReplaceSelectionCommand.cpp

    r201205 r201823  
    915915    ASSERT(selection.isCaretOrRange());
    916916    ASSERT(selection.start().deprecatedNode());
    917     if (!selection.isNonOrphanedCaretOrRange() || !selection.start().deprecatedNode())
    918         return;
    919 
    920     if (!selection.rootEditableElement())
     917    if (selection.isNoneOrOrphaned() || !selection.start().deprecatedNode() || !selection.isContentEditable())
    921918        return;
    922919

  • trunk/Source/WebCore/editing/SetSelectionCommand.cpp

    r165676 r201823  
    4343    FrameSelection& selection = frame().selection();
    4444
    45     if (selection.shouldChangeSelection(m_selectionToSet) && m_selectionToSet.isNonOrphanedCaretOrRange()) {
     45    if (selection.shouldChangeSelection(m_selectionToSet) && !m_selectionToSet.isNoneOrOrphaned()) {
    4646        selection.setSelection(m_selectionToSet, m_options);
    4747        setEndingSelection(m_selectionToSet);
    … …  
    5353    FrameSelection& selection = frame().selection();
    5454
    55     if (selection.shouldChangeSelection(startingSelection()) && startingSelection().isNonOrphanedCaretOrRange())
     55    if (selection.shouldChangeSelection(startingSelection()) && !startingSelection().isNoneOrOrphaned())
    5656        selection.setSelection(startingSelection(), m_options);
    5757}

  • trunk/Source/WebCore/editing/TypingCommand.cpp

    r200922 r201823  
    262262void TypingCommand::doApply()
    263263{
    264     if (!endingSelection().isNonOrphanedCaretOrRange())
    265         return;
    266        
     264    if (endingSelection().isNoneOrOrphaned())
     265        return;
     266
    267267    if (m_commandType == DeleteKey)
    268268        if (m_commands.isEmpty())

  • trunk/Source/WebCore/editing/VisibleSelection.cpp

    r201667 r201823  
    126126RefPtr<Range> VisibleSelection::firstRange() const
    127127{
    128     if (isNone())
     128    if (isNoneOrOrphaned())
    129129        return nullptr;
    130130    Position start = m_start.parentAnchoredEquivalent();
    131131    Position end = m_end.parentAnchoredEquivalent();
    132     if (start.isNull() || end.isNull())
     132    if (start.isNull() || start.isOrphan() || end.isNull() || end.isOrphan())
    133133        return nullptr;
    134134    return Range::create(start.anchorNode()->document(), start, end);
    … …  
    137137RefPtr<Range> VisibleSelection::toNormalizedRange() const
    138138{
    139     if (isNone())
     139    if (isNoneOrOrphaned())
    140140        return nullptr;
    141141
    … …  
    147147
    148148    // Check again, because updating layout can clear the selection.
    149     if (isNone())
     149    if (isNoneOrOrphaned())
    150150        return nullptr;
    151151

  • trunk/Source/WebCore/editing/VisibleSelection.h

    r198583 r201823  
    7878    bool isCaretOrRange() const { return selectionType() != NoSelection; }
    7979    bool isNonOrphanedRange() const { return isRange() && !start().isOrphan() && !end().isOrphan(); }
    80     bool isNonOrphanedCaretOrRange() const { return isCaretOrRange() && !start().isOrphan() && !end().isOrphan(); }
     80    bool isNoneOrOrphaned() const { return isNone() || start().isOrphan() || end().isOrphan(); }
    8181
    8282    bool isBaseFirst() const { return m_baseIsFirst; }
Note: See TracChangeset for help on using the changeset viewer.