Title: [99886] trunk
- Revision
- 99886
- Author
- [email protected]
- Date
- 2011-11-10 11:51:58 -0800 (Thu, 10 Nov 2011)
Log Message
Source/WebCore: --webkit-visual-word crash when create legacy position for shadowRoot
https://bugs.webkit.org/show_bug.cgi?id=71600
Reviewed by Ryosuke Niwa.
Inside textarea, the shadowed text node's previous leaf node could be the
shadowRoot node, which cause assert exception in creating legacy position based
on such node. Exit previousRootInlineBox() when reach shadowRoot node.
It does not cause problem when looking for text node's next leaf node. Adding
the same checking in nextRootInlineBox just to be safe.
Test: editing/selection/move-by-word-visually-crash-test-textarea.html
* editing/visible_units.cpp:
(WebCore::previousRootInlineBox):
(WebCore::nextRootInlineBox):
LayoutTests: --webkit-visual-word crash when create legacy position for shadowRoot
https://bugs.webkit.org/show_bug.cgi?id=71600
Reviewed by Ryosuke Niwa.
* editing/selection/move-by-word-visually-crash-test-textarea-expected.txt: Added.
* editing/selection/move-by-word-visually-crash-test-textarea.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (99885 => 99886)
--- trunk/LayoutTests/ChangeLog 2011-11-10 19:36:23 UTC (rev 99885)
+++ trunk/LayoutTests/ChangeLog 2011-11-10 19:51:58 UTC (rev 99886)
@@ -1,3 +1,13 @@
+2011-11-10 Xiaomei Ji <[email protected]>
+
+ --webkit-visual-word crash when create legacy position for shadowRoot
+ https://bugs.webkit.org/show_bug.cgi?id=71600
+
+ Reviewed by Ryosuke Niwa.
+
+ * editing/selection/move-by-word-visually-crash-test-textarea-expected.txt: Added.
+ * editing/selection/move-by-word-visually-crash-test-textarea.html: Added.
+
2011-11-10 Ojan Vafai <[email protected]>
Add line for very flaky test storage/indexeddb/factory-deletedatabase-interactions.html.
Added: trunk/LayoutTests/editing/selection/move-by-word-visually-crash-test-textarea-expected.txt (0 => 99886)
--- trunk/LayoutTests/editing/selection/move-by-word-visually-crash-test-textarea-expected.txt (rev 0)
+++ trunk/LayoutTests/editing/selection/move-by-word-visually-crash-test-textarea-expected.txt 2011-11-10 19:51:58 UTC (rev 99886)
@@ -0,0 +1 @@
+Crash test passed
Added: trunk/LayoutTests/editing/selection/move-by-word-visually-crash-test-textarea.html (0 => 99886)
--- trunk/LayoutTests/editing/selection/move-by-word-visually-crash-test-textarea.html (rev 0)
+++ trunk/LayoutTests/editing/selection/move-by-word-visually-crash-test-textarea.html 2011-11-10 19:51:58 UTC (rev 99886)
@@ -0,0 +1,22 @@
+<script>
+
+_onload_ = function() {
+ var sel = window.getSelection();
+ sel.empty();
+
+ var test = document.getElementById("test_move_by_word");
+ test.focus();
+ test.selectionDirection = 'none';
+ test.selectionStart = 1;
+ test.selectionEnd = 1;
+
+ getSelection().modify("move", "left", "-webkit-visual-word");
+ getSelection().modify("move", "left", "-webkit-visual-word");
+ document.body.innerHTML = "Crash test passed";
+};
+
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+</script>
+
+<textarea dir=ltr title="0|0" id="test_move_by_word">At where are you</textarea>
Modified: trunk/Source/WebCore/ChangeLog (99885 => 99886)
--- trunk/Source/WebCore/ChangeLog 2011-11-10 19:36:23 UTC (rev 99885)
+++ trunk/Source/WebCore/ChangeLog 2011-11-10 19:51:58 UTC (rev 99886)
@@ -1,3 +1,23 @@
+2011-11-10 Xiaomei Ji <[email protected]>
+
+ --webkit-visual-word crash when create legacy position for shadowRoot
+ https://bugs.webkit.org/show_bug.cgi?id=71600
+
+ Reviewed by Ryosuke Niwa.
+
+ Inside textarea, the shadowed text node's previous leaf node could be the
+ shadowRoot node, which cause assert exception in creating legacy position based
+ on such node. Exit previousRootInlineBox() when reach shadowRoot node.
+
+ It does not cause problem when looking for text node's next leaf node. Adding
+ the same checking in nextRootInlineBox just to be safe.
+
+ Test: editing/selection/move-by-word-visually-crash-test-textarea.html
+
+ * editing/visible_units.cpp:
+ (WebCore::previousRootInlineBox):
+ (WebCore::nextRootInlineBox):
+
2011-11-10 Dean Jackson <[email protected]>
Parse drop-shadow() filter syntax
Modified: trunk/Source/WebCore/editing/visible_units.cpp (99885 => 99886)
--- trunk/Source/WebCore/editing/visible_units.cpp 2011-11-10 19:36:23 UTC (rev 99885)
+++ trunk/Source/WebCore/editing/visible_units.cpp 2011-11-10 19:51:58 UTC (rev 99886)
@@ -1434,7 +1434,7 @@
while (previousNode && enclosingBlockNode == enclosingNodeWithNonInlineRenderer(previousNode))
previousNode = previousNode->previousLeafNode();
- while (previousNode) {
+ while (previousNode && !previousNode->isShadowRoot()) {
Position pos = createLegacyEditingPosition(previousNode, caretMaxOffset(previousNode));
if (pos.isCandidate()) {
@@ -1457,7 +1457,7 @@
while (nextNode && enclosingBlockNode == enclosingNodeWithNonInlineRenderer(nextNode))
nextNode = nextNode->nextLeafNode();
- while (nextNode) {
+ while (nextNode && !nextNode->isShadowRoot()) {
Position pos;
pos = createLegacyEditingPosition(nextNode, caretMinOffset(nextNode));
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
