Changeset 153366 in webkit

Timestamp:

Jul 25, 2013 8:59:22 PM (11 years ago)

Author:

rniwa@webkit.org

Message:

Fix document leak when selection is created inside the document
​https://bugs.webkit.org/show_bug.cgi?id=119122

Reviewed by Andreas Kling.

Source/WebCore:

Merge ​https://chromium.googlesource.com/chromium/blink/+/b908cb4c8da93316d787de31c93f2a43de332a10

The bug was caused by FrameSelection::m_previousCaretNode holding onto a Node, leaking its document.
Fixed the bug by explicitly clearing it in FrameSelection::prepareForDestruction.

Test: editing/selection/leak-document-with-selection-inside.html

• editing/FrameSelection.cpp:

(WebCore::FrameSelection::prepareForDestruction):

LayoutTests:

Added a regression test.

• editing/selection/leak-document-with-selection-inside-expected.txt: Added.
• editing/selection/leak-document-with-selection-inside.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/editing/selection/leak-document-with-selection-inside-expected.txt (added)
• LayoutTests/editing/selection/leak-document-with-selection-inside.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/editing/FrameSelection.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2013-07-25  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Fix document leak when selection is created inside the document
+        https://bugs.webkit.org/show_bug.cgi?id=119122
+
+        Reviewed by Andreas Kling.
+
+        Added a regression test.
+
+        * editing/selection/leak-document-with-selection-inside-expected.txt: Added.
+        * editing/selection/leak-document-with-selection-inside.html: Added.
+
 2013-07-25  Bem Jones-Bey  <bjonesbe@adobe.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2013-07-25  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Fix document leak when selection is created inside the document
+        https://bugs.webkit.org/show_bug.cgi?id=119122
+
+        Reviewed by Andreas Kling.
+
+        Merge https://chromium.googlesource.com/chromium/blink/+/b908cb4c8da93316d787de31c93f2a43de332a10
+
+        The bug was caused by FrameSelection::m_previousCaretNode holding onto a Node, leaking its document.
+        Fixed the bug by explicitly clearing it in FrameSelection::prepareForDestruction.
+
+        Test: editing/selection/leak-document-with-selection-inside.html
+
+        * editing/FrameSelection.cpp:
+        (WebCore::FrameSelection::prepareForDestruction):
+
 2013-07-25  Andreas Kling  <akling@apple.com>
 

trunk/Source/WebCore/editing/FrameSelection.cpp

@@ -1210 +1210 @@
 
     setSelection(VisibleSelection(), CloseTyping | ClearTypingStyle | DoNotUpdateAppearance);
+    m_previousCaretNode.clear();
 }