Changeset 112197 in webkit

Timestamp:

Mar 26, 2012 7:42:48 PM (12 years ago)

Author:

shinyak@chromium.org

Message:

Triggers assertion if dragging from outside of <meter> in a shadow tree to inside of it.
​https://bugs.webkit.org/show_bug.cgi?id=82177

Reviewed by Dimitri Glazkov.

Source/WebCore:

VisibleSelection::adjustSelectionToAvoidCrossingShadowBoundaries has moved the start position or
the end position to the invalid position, i.e. position after (before) the non-existing node.

This patch fixes the problem, and adds assertion that the selection does not cross shadow boundaries.

Test: fast/dom/shadow/drag-to-meter-in-shadow-crash.html

• editing/VisibleSelection.cpp:

(WebCore::VisibleSelection::adjustSelectionToAvoidCrossingShadowBoundaries):

LayoutTests:

• fast/dom/shadow/drag-to-meter-in-shadow-crash-expected.txt: Added.
• fast/dom/shadow/drag-to-meter-in-shadow-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/dom/shadow/drag-to-meter-in-shadow-crash-expected.txt (added)
• LayoutTests/fast/dom/shadow/drag-to-meter-in-shadow-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/editing/VisibleSelection.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2012-03-26  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Triggers assertion if dragging from outside of <meter> in a shadow tree to inside of it.
+        https://bugs.webkit.org/show_bug.cgi?id=82177
+
+        Reviewed by Dimitri Glazkov.
+
+        * fast/dom/shadow/drag-to-meter-in-shadow-crash-expected.txt: Added.
+        * fast/dom/shadow/drag-to-meter-in-shadow-crash.html: Added.
+
 2012-03-26  Adam Barth  <abarth@webkit.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2012-03-26  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Triggers assertion if dragging from outside of <meter> in a shadow tree to inside of it.
+        https://bugs.webkit.org/show_bug.cgi?id=82177
+
+        Reviewed by Dimitri Glazkov.
+
+        VisibleSelection::adjustSelectionToAvoidCrossingShadowBoundaries has moved the start position or
+        the end position to the invalid position, i.e. position after (before) the non-existing node.
+
+        This patch fixes the problem, and adds assertion that the selection does not cross shadow boundaries.
+
+        Test: fast/dom/shadow/drag-to-meter-in-shadow-crash.html
+
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::adjustSelectionToAvoidCrossingShadowBoundaries):
+
 2012-03-26  Scott Byer  <scottbyer@chromium.org>
 

trunk/Source/WebCore/editing/VisibleSelection.cpp

@@ -472 +472 @@
 
     if (m_baseIsFirst) {
-        m_extent = startRootNode ? lastPositionInNode(startRootNode) : positionBeforeNode(endRootNode->shadowAncestorNode());
+        m_extent = startRootNode ? lastPositionInOrAfterNode(startRootNode) : positionBeforeNode(endRootNode->shadowAncestorNode());
         m_end = m_extent;
     } else {
-        m_extent = endRootNode ? firstPositionInNode(endRootNode) : positionAfterNode(startRootNode->shadowAncestorNode());
+        m_extent = endRootNode ? firstPositionInOrBeforeNode(endRootNode) : positionAfterNode(startRootNode->shadowAncestorNode());
         m_start = m_extent;
     }
+
+    ASSERT(m_start.anchorNode()->treeScope() == m_end.anchorNode()->treeScope());
 }