Changeset 73176 in webkit

Timestamp:

Dec 2, 2010 11:56:06 AM (13 years ago)

Author:

dimich@chromium.org

Message:

Merge 72863 - Crash when iframe transfers from one page to another and has child frames.
​https://bugs.webkit.org/show_bug.cgi?id=50200

Reviewed by David Levin.

• page/Frame.cpp:

(WebCore::Frame::transferChildFrameToNewDocument):
avoid overriding 'didTransfer' which has the result of previous check.

TBR=​dimich@chromium.org
Review URL: ​http://codereview.chromium.org/5564003

Location:

branches/chromium/597/WebCore

Files:

• ChangeLog (modified) (1 diff)
• page/Frame.cpp (modified) (1 diff)

branches/chromium/597/WebCore/ChangeLog

@@ -1 @@
-2010-12-01  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Darin Adler, Tony Chang, and unofficially by Enrica Casucci.
-
-        chrome.dll!WebCore::RangeBoundaryPoint::toPosition ReadAV@NULL (cf0d0f28bc56f2591cc74f71b46036ea)
-        https://bugs.webkit.org/show_bug.cgi?id=47808
-
-        The crash was caused by moveParagraphWithClones' not copying the entire paragraph
-        when called by doApplyForSingleParagraph, which was induced by a bug in
-        cloneParagraphUnderNewElement which ended the cloning process early when the start node
-        and the end node didn't share the same parent node. Fixed the bug in cloneParagraphUnderNewElement
-        by calling traverseNextSibling(outerNode) instead of nextSibling().
-
-        Also added an early exit to InsertListCommand::doApply when lastSelectionRange is null.
-
-        Tests: editing/execCommand/switch-multiple-list-items-crash.html
-               editing/execCommand/switch-multiple-list-items.html
-
-        * editing/CompositeEditCommand.cpp:
-        (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement):
-        * editing/InsertListCommand.cpp:
-        (WebCore::InsertListCommand::doApply):
+2010-11-29  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Crash when iframe transfers from one page to another and has child frames.
+        https://bugs.webkit.org/show_bug.cgi?id=50200
+
+        * page/Frame.cpp:
+        (WebCore::Frame::transferChildFrameToNewDocument):
+        avoid overriding 'didTransfer' which has the result of previous check.
+
+2010-11-19  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        up arrow doesn't work with RTL text with word wrapping
+        https://bugs.webkit.org/show_bug.cgi?id=41987
+
+        The bug was caused by positionForPoint's not returning the correct affinity when the x coordiate
+        is to the left of the first line, and startOfLine's incorrectly moving position to the previous candidate.
+
+        Fixed the bug by returning upstream VisiblePosition in positionForPoint if the first inline text box's offset
+        is greater than 0.  Also removed the code added by http://trac.webkit.org/changeset/23608 since this changeset
+        does not add any test, and the problem described in the changelog reproduces regardless of the code's presence.
+
+        Tests: editing/selection/click-left-of-rtl-wrapping-text.html
+               editing/selection/modify-up-on-rtl-wrapping-text.html
+
+        * editing/visible_units.cpp:
+        (WebCore::startOfLine):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::positionForPoint):
 
 2010-11-29  Ilya Sherman  <isherman@chromium.org>

branches/chromium/597/WebCore/page/Frame.cpp

@@ -735 +735 @@
 
     // Update the frame tree.
-    didTransfer = newParent->tree()->transferChild(this);
+    didTransfer = newParent->tree()->transferChild(this) || didTransfer;
 
     // Avoid unnecessary calls to client and frame subtree if the frame ended