Changeset 92966 in webkit


Ignore:
Timestamp:
Aug 12, 2011, 9:27:57 AM (14 years ago)
Author:
inferno@chromium.org
Message:

Crash in WebCore::editingIgnoresContent
​https://bugs.webkit.org/show_bug.cgi?id=66125

Reviewed by Ryosuke Niwa.

Source/WebCore:

RefPtr a few nodes in case they get blown away in
dispatchEvent calls.

Test: editing/selection/select-start-remove-root-crash.html

  • editing/FrameSelection.cpp:

(WebCore::FrameSelection::selectAll):

  • editing/ReplaceSelectionCommand.cpp:

(WebCore::ReplacementFragment::ReplacementFragment):

LayoutTests:

Tests that we do not crash when we blow away the root
during the firing of selectstart event in selection.

  • editing/selection/select-start-remove-root-crash-expected.txt: Added.
  • editing/selection/select-start-remove-root-crash.html: Added.
Location:
trunk
Files:
2 added
4 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r92961 r92966  
     12011-08-12  Abhishek Arya  <inferno@chromium.org>
     2
     3        Crash in WebCore::editingIgnoresContent
     4        https://bugs.webkit.org/show_bug.cgi?id=66125
     5
     6        Reviewed by Ryosuke Niwa.
     7
     8        Tests that we do not crash when we blow away the root
     9        during the firing of selectstart event in selection.
     10
     11        * editing/selection/select-start-remove-root-crash-expected.txt: Added.
     12        * editing/selection/select-start-remove-root-crash.html: Added.
     13
    1142011-08-12  Yury Semikhatsky  <yurys@chromium.org>
    215

  • trunk/Source/WebCore/ChangeLog

    r92964 r92966  
     12011-08-12  Abhishek Arya  <inferno@chromium.org>
     2
     3        Crash in WebCore::editingIgnoresContent
     4        https://bugs.webkit.org/show_bug.cgi?id=66125
     5
     6        Reviewed by Ryosuke Niwa.
     7
     8        RefPtr a few nodes in case they get blown away in
     9        dispatchEvent calls.
     10
     11        Test: editing/selection/select-start-remove-root-crash.html
     12
     13        * editing/FrameSelection.cpp:
     14        (WebCore::FrameSelection::selectAll):
     15        * editing/ReplaceSelectionCommand.cpp:
     16        (WebCore::ReplacementFragment::ReplacementFragment):
     17
    1182011-08-11  Pavel Podivilov  <podivilov@chromium.org>
    219

  • trunk/Source/WebCore/editing/FrameSelection.cpp

    r90591 r92966  
    14321432    }
    14331433
    1434     Node* root = 0;
     1434    RefPtr<Node> root = 0;
    14351435    Node* selectStartTarget = 0;
    14361436    if (isContentEditable()) {
    … …  
    14391439            selectStartTarget = shadowRoot->shadowAncestorNode();
    14401440        else
    1441             selectStartTarget = root;
     1441            selectStartTarget = root.get();
    14421442    } else {
    14431443        root = m_selection.nonBoundaryShadowTreeRootNode();
    … …  
    14551455        return;
    14561456
    1457     VisibleSelection newSelection(VisibleSelection::selectionFromContentsOfNode(root));
     1457    VisibleSelection newSelection(VisibleSelection::selectionFromContentsOfNode(root.get()));
    14581458
    14591459    if (shouldChangeSelection(newSelection))

  • trunk/Source/WebCore/editing/ReplaceSelectionCommand.cpp

    r92695 r92966  
    140140        return;
    141141   
    142     Element* editableRoot = selection.rootEditableElement();
     142    RefPtr<Element> editableRoot = selection.rootEditableElement();
    143143    ASSERT(editableRoot);
    144144    if (!editableRoot)
    … …  
    155155    }
    156156
    157     Node* styleNode = selection.base().deprecatedNode();
    158     RefPtr<StyledElement> holder = insertFragmentForTestRendering(styleNode);
     157    RefPtr<Node> styleNode = selection.base().deprecatedNode();
     158    RefPtr<StyledElement> holder = insertFragmentForTestRendering(styleNode.get());
    159159    if (!holder) {
    160160        removeInterchangeNodes(m_fragment.get());
    … …  
    176176        if (!m_fragment->firstChild())
    177177            return;
    178         holder = insertFragmentForTestRendering(styleNode);
     178        holder = insertFragmentForTestRendering(styleNode.get());
    179179    }
    180180   
Note: See TracChangeset for help on using the changeset viewer.