Changeset 58149 in webkit
- Timestamp:
- Apr 22, 2010 9:51:39 PM (14 years ago)
- Location:
- trunk
- Files:
-
- 5 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/LayoutTests/ChangeLog
r58137 r58149 1 2010-04-22 Shinichiro Hamaji <hamaji@chromium.org> 2 3 Reviewed by Darin Adler. 4 5 REGRESSION: TextIterator may use freed memory 6 https://bugs.webkit.org/show_bug.cgi?id=37973 7 8 * platform/chromium/test_expectations.txt: 9 1 10 2010-04-22 Yuzo Fujishima <yuzo@google.com> 2 11 -
trunk/LayoutTests/platform/chromium/test_expectations.txt
r58137 r58149 2748 2748 BUGJAMESR BUG30048 BUG29737 : svg/filters/shadow-on-rect-with-filter.svg = IMAGE 2749 2749 2750 // Broke at r579402751 BUGWK37907 WIN : editing/pasteboard/copy-backslash-with-euc.html = FAIL2752 2753 2750 // New layoutTestController function added at r57986 2754 2751 BUGJAMESR : fast/lists/ol-nested-items-dynamic-insert.html = TEXT -
trunk/WebCore/ChangeLog
r58145 r58149 1 2010-04-22 Shinichiro Hamaji <hamaji@chromium.org> 2 3 Reviewed by Darin Adler. 4 5 REGRESSION: TextIterator may use freed memory 6 https://bugs.webkit.org/show_bug.cgi?id=37973 7 8 Added TextIterator::m_text to hold the returned String. 9 10 No new tests because there are no behavior change, but 11 copy-backslash-with-euc.html on chromium-win should test this. 12 13 * editing/TextIterator.cpp: 14 (WebCore::TextIterator::emitText): 15 * editing/TextIterator.h: 16 1 17 2010-04-22 Michael Forney <mforney@mforney.org> 2 18 -
trunk/WebCore/editing/TextIterator.cpp
r58040 r58149 892 892 { 893 893 RenderText* renderer = toRenderText(m_node->renderer()); 894 String str= m_emitsTextWithoutTranscoding ? renderer->textWithoutTranscoding() : renderer->text();895 ASSERT( str.characters());894 m_text = m_emitsTextWithoutTranscoding ? renderer->textWithoutTranscoding() : renderer->text(); 895 ASSERT(m_text.characters()); 896 896 897 897 m_positionNode = textNode; … … 899 899 m_positionStartOffset = textStartOffset; 900 900 m_positionEndOffset = textEndOffset; 901 m_textCharacters = str.characters() + textStartOffset;901 m_textCharacters = m_text.characters() + textStartOffset; 902 902 m_textLength = textEndOffset - textStartOffset; 903 m_lastCharacter = str[textEndOffset - 1];903 m_lastCharacter = m_text[textEndOffset - 1]; 904 904 905 905 m_lastTextNodeEndedWithCollapsedSpace = false; -
trunk/WebCore/editing/TextIterator.h
r58040 r58149 128 128 const UChar* m_textCharacters; 129 129 int m_textLength; 130 130 // Hold string m_textCharacters points to so we ensure it won't be deleted. 131 String m_text; 132 131 133 // Used when there is still some pending text from the current node; when these 132 134 // are false and 0, we go back to normal iterating.
Note: See TracChangeset
for help on using the changeset viewer.