Changeset 106380 in webkit

Timestamp:

Jan 31, 2012 12:41:05 PM (12 years ago)

Author:

rniwa@webkit.org

Message:

Source/WebCore: Crash in DeleteSelectionCommand::handleGeneralDelete when attempting to delete the start block
​https://bugs.webkit.org/show_bug.cgi?id=77077

Reviewed by Enrica Casucci.

The crash was caused by a missing null check after removing the position out of the start block.
Fixed the bug by adding an early return.

Tests: editing/deleting/delete-start-block.html

editing/selection/move-into-empty-root-inline-box.html

• editing/DeleteSelectionCommand.cpp:

(WebCore::DeleteSelectionCommand::handleGeneralDelete):

LayoutTests: Crash in previousLinePosition when moving into a root inline box without leaves
​https://bugs.webkit.org/show_bug.cgi?id=76812

Reviewed by Enrica Casucci.

Add a regression test for the crash. Unfortunately, we can only test previousLinePosition.

• editing/selection/move-into-empty-root-inline-box-expected.txt: Added.
• editing/selection/move-into-empty-root-inline-box.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/editing/deleting/delete-start-block-expected.txt (added)
• LayoutTests/editing/deleting/delete-start-block.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/editing/DeleteSelectionCommand.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2012-01-31  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Crash in previousLinePosition when moving into a root inline box without leaves
+        https://bugs.webkit.org/show_bug.cgi?id=76812
+
+        Reviewed by Enrica Casucci.
+
+        Add a regression test for the crash. Unfortunately, we can only test previousLinePosition.
+
+        * editing/selection/move-into-empty-root-inline-box-expected.txt: Added.
+        * editing/selection/move-into-empty-root-inline-box.html: Added.
+
 2012-01-31  Tony Chang  <tony@chromium.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2012-01-31  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Crash in DeleteSelectionCommand::handleGeneralDelete when attempting to delete the start block
+        https://bugs.webkit.org/show_bug.cgi?id=77077
+
+        Reviewed by Enrica Casucci.
+
+        The crash was caused by a missing null check after removing the position out of the start block.
+        Fixed the bug by adding an early return.
+
+        Tests: editing/deleting/delete-start-block.html
+               editing/selection/move-into-empty-root-inline-box.html
+
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::handleGeneralDelete):
+
 2012-01-31  Rafael Brandao  <rafael.lobo@openbossa.org>
 

trunk/Source/WebCore/editing/DeleteSelectionCommand.cpp

@@ -419 +419 @@
         startOffset = 0;
         startNode = startNode->traverseNextNode();
+        if (!startNode)
+            return;
     }