Changeset 99886 in webkit

Timestamp:

Nov 10, 2011 11:51:58 AM (12 years ago)

Author:

xji@chromium.org

Message:

Source/WebCore: --webkit-visual-word crash when create legacy position for shadowRoot
​https://bugs.webkit.org/show_bug.cgi?id=71600

Reviewed by Ryosuke Niwa.

Inside textarea, the shadowed text node's previous leaf node could be the
shadowRoot node, which cause assert exception in creating legacy position based
on such node. Exit previousRootInlineBox() when reach shadowRoot node.

It does not cause problem when looking for text node's next leaf node. Adding
the same checking in nextRootInlineBox just to be safe.

Test: editing/selection/move-by-word-visually-crash-test-textarea.html

• editing/visible_units.cpp:

(WebCore::previousRootInlineBox):
(WebCore::nextRootInlineBox):

LayoutTests: --webkit-visual-word crash when create legacy position for shadowRoot
​https://bugs.webkit.org/show_bug.cgi?id=71600

Reviewed by Ryosuke Niwa.

• editing/selection/move-by-word-visually-crash-test-textarea-expected.txt: Added.
• editing/selection/move-by-word-visually-crash-test-textarea.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/editing/selection/move-by-word-visually-crash-test-textarea-expected.txt (added)
• LayoutTests/editing/selection/move-by-word-visually-crash-test-textarea.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/editing/visible_units.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-11-10  Xiaomei Ji  <xji@chromium.org>
+
+        --webkit-visual-word crash when create legacy position for shadowRoot
+        https://bugs.webkit.org/show_bug.cgi?id=71600
+
+        Reviewed by Ryosuke Niwa.
+
+        * editing/selection/move-by-word-visually-crash-test-textarea-expected.txt: Added.
+        * editing/selection/move-by-word-visually-crash-test-textarea.html: Added.
+
 2011-11-10  Ojan Vafai  <ojan@chromium.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-11-10  Xiaomei Ji  <xji@chromium.org>
+
+        --webkit-visual-word crash when create legacy position for shadowRoot
+        https://bugs.webkit.org/show_bug.cgi?id=71600
+    
+        Reviewed by Ryosuke Niwa.
+
+        Inside textarea, the shadowed text node's previous leaf node could be the
+        shadowRoot node, which cause assert exception in creating legacy position based
+        on such node. Exit previousRootInlineBox() when reach shadowRoot node.
+
+        It does not cause problem when looking for text node's next leaf node. Adding
+        the same checking in nextRootInlineBox just to be safe.
+
+        Test: editing/selection/move-by-word-visually-crash-test-textarea.html
+
+        * editing/visible_units.cpp:
+        (WebCore::previousRootInlineBox):
+        (WebCore::nextRootInlineBox):
+
 2011-11-10  Dean Jackson  <dino@apple.com>
 

trunk/Source/WebCore/editing/visible_units.cpp

@@ -1435 +1435 @@
         previousNode = previousNode->previousLeafNode();
   
-    while (previousNode) {
+    while (previousNode && !previousNode->isShadowRoot()) {
         Position pos = createLegacyEditingPosition(previousNode, caretMaxOffset(previousNode));
         
@@ -1458 +1458 @@
         nextNode = nextNode->nextLeafNode();
   
-    while (nextNode) {
+    while (nextNode && !nextNode->isShadowRoot()) {
         Position pos;
         pos = createLegacyEditingPosition(nextNode, caretMinOffset(nextNode));