Changeset 105050 in webkit

Timestamp:

Jan 16, 2012 3:31:38 AM (12 years ago)

Author:

commit-queue@webkit.org

Message:

[crash] Renderer crashes when spell checking a disabled input field.
​https://bugs.webkit.org/show_bug.cgi?id=75941

Patch by Shinya Kawanaka <​shinyak@google.com> on 2012-01-16
Reviewed by Hajime Morita.

.:

• ManualTests/editing-disabled-node-replace-crash.html: Added.

Source/WebCore:

We confirm the selection is editable before replacing text.

Tests: ManualTests/editing-disabled-node-replace-crash.html

• editing/Editor.cpp:

(WebCore::Editor::replaceSelectionWithFragment):

• editing/ReplaceSelectionCommand.cpp:

(WebCore::ReplaceSelectionCommand::doApply):

Location:

trunk

Files:

• ChangeLog (modified) (1 diff)
• ManualTests/editing-disabled-node-replace-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/editing/Editor.cpp (modified) (1 diff)
• Source/WebCore/editing/ReplaceSelectionCommand.cpp (modified) (1 diff)

trunk/ChangeLog

@@ +1 @@
+2012-01-16  Shinya Kawanaka  <shinyak@google.com>
+
+        [crash] Renderer crashes when spell checking a disabled input field.
+        https://bugs.webkit.org/show_bug.cgi?id=75941
+
+        Reviewed by Hajime Morita.
+
+        * ManualTests/editing-disabled-node-replace-crash.html: Added.
+
 2012-01-13  Simon Fraser  <simon.fraser@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2012-01-16  Shinya Kawanaka  <shinyak@google.com>
+
+        [crash] Renderer crashes when spell checking a disabled input field.
+        https://bugs.webkit.org/show_bug.cgi?id=75941
+
+        Reviewed by Hajime Morita.
+
+        We confirm the selection is editable before replacing text.
+
+        Tests: ManualTests/editing-disabled-node-replace-crash.html
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::replaceSelectionWithFragment):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::doApply):
+
 2012-01-16  Pablo Flouret  <pablof@motorola.com>
 

trunk/Source/WebCore/editing/Editor.cpp

@@ -401 +401 @@
 void Editor::replaceSelectionWithFragment(PassRefPtr<DocumentFragment> fragment, bool selectReplacement, bool smartReplace, bool matchStyle)
 {
-    if (m_frame->selection()->isNone() || !fragment)
+    if (m_frame->selection()->isNone() || !m_frame->selection()->isContentEditable() || !fragment)
         return;
 

trunk/Source/WebCore/editing/ReplaceSelectionCommand.cpp

@@ -818 +818 @@
         return;
 
+    if (!selection.rootEditableElement())
+        return;
+
     ReplacementFragment fragment(document(), m_documentFragment.get(), m_matchStyle, selection);
     if (performTrivialReplace(fragment))