Title: [137213] trunk
- Revision
- 137213
- Author
- commit-qu...@webkit.org
- Date
- 2012-12-10 15:30:36 -0800 (Mon, 10 Dec 2012)
Log Message
Keyboard caret movement in textarea with RTL Override Character can make tab unresponsive
https://bugs.webkit.org/show_bug.cgi?id=103067
Patch by Yi Shen <max.hong.s...@gmail.com> on 2012-12-10
Reviewed by Ryosuke Niwa.
Source/WebCore:
For textarea with RTL override character, the line break could be the previous leaf InlineTextBox of
the InlineTextBox for the RTL override text. When overshots the left/right, make sure the
leftVisuallyDistinctCandidate and rightVisuallyDistinctCandidate return the visually distinct
left/right position by ignoring the line break.
Test: editing/selection/move-by-character-crash-test-textarea.html
* editing/VisiblePosition.cpp:
(WebCore::VisiblePosition::leftVisuallyDistinctCandidate):
(WebCore::VisiblePosition::rightVisuallyDistinctCandidate):
LayoutTests:
New test for moving caret in textarea with RTL override character causes crash.
* editing/selection/move-by-character-crash-test-textarea-expected.txt: Added.
* editing/selection/move-by-character-crash-test-textarea.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (137212 => 137213)
--- trunk/LayoutTests/ChangeLog 2012-12-10 23:06:42 UTC (rev 137212)
+++ trunk/LayoutTests/ChangeLog 2012-12-10 23:30:36 UTC (rev 137213)
@@ -1,3 +1,15 @@
+2012-12-10 Yi Shen <max.hong.s...@gmail.com>
+
+ Keyboard caret movement in textarea with RTL Override Character can make tab unresponsive
+ https://bugs.webkit.org/show_bug.cgi?id=103067
+
+ Reviewed by Ryosuke Niwa.
+
+ New test for moving caret in textarea with RTL override character causes crash.
+
+ * editing/selection/move-by-character-crash-test-textarea-expected.txt: Added.
+ * editing/selection/move-by-character-crash-test-textarea.html: Added.
+
2012-12-10 Dirk Pranke <dpra...@chromium.org>
nrwt: use the default logic for skipping platform-specific tests for chromium
Added: trunk/LayoutTests/editing/selection/move-by-character-crash-test-textarea-expected.txt (0 => 137213)
--- trunk/LayoutTests/editing/selection/move-by-character-crash-test-textarea-expected.txt (rev 0)
+++ trunk/LayoutTests/editing/selection/move-by-character-crash-test-textarea-expected.txt 2012-12-10 23:30:36 UTC (rev 137213)
@@ -0,0 +1 @@
+PASS
Added: trunk/LayoutTests/editing/selection/move-by-character-crash-test-textarea.html (0 => 137213)
--- trunk/LayoutTests/editing/selection/move-by-character-crash-test-textarea.html (rev 0)
+++ trunk/LayoutTests/editing/selection/move-by-character-crash-test-textarea.html 2012-12-10 23:30:36 UTC (rev 137213)
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html>
+<body>
+This test sets caret at the beginning of backward text and moving the character to left and right. WebKit should not crash and you should see PASS below:
+<textarea id="editor">‮LTR
+</textarea>
+<script>
+_onload_ = function() {
+ var sel = window.getSelection();
+ sel.empty();
+ var test = document.getElementById("editor");
+ test.focus();
+ test.selectionDirection = 'none';
+ test.selectionStart = 0;
+ test.selectionEnd = 0;
+ getSelection().modify("move", "left", "character");
+ getSelection().modify("move", "left", "character");
+ test.selectionDirection = 'none';
+ test.selectionStart = 1;
+ test.selectionEnd = 1;
+ getSelection().modify("move", "right", "character");
+ getSelection().modify("move", "right", "character");
+ document.body.innerHTML = "PASS";
+};
+
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+</script>
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (137212 => 137213)
--- trunk/Source/WebCore/ChangeLog 2012-12-10 23:06:42 UTC (rev 137212)
+++ trunk/Source/WebCore/ChangeLog 2012-12-10 23:30:36 UTC (rev 137213)
@@ -1,3 +1,21 @@
+2012-12-10 Yi Shen <max.hong.s...@gmail.com>
+
+ Keyboard caret movement in textarea with RTL Override Character can make tab unresponsive
+ https://bugs.webkit.org/show_bug.cgi?id=103067
+
+ Reviewed by Ryosuke Niwa.
+
+ For textarea with RTL override character, the line break could be the previous leaf InlineTextBox of
+ the InlineTextBox for the RTL override text. When overshots the left/right, make sure the
+ leftVisuallyDistinctCandidate and rightVisuallyDistinctCandidate return the visually distinct
+ left/right position by ignoring the line break.
+
+ Test: editing/selection/move-by-character-crash-test-textarea.html
+
+ * editing/VisiblePosition.cpp:
+ (WebCore::VisiblePosition::leftVisuallyDistinctCandidate):
+ (WebCore::VisiblePosition::rightVisuallyDistinctCandidate):
+
2012-12-10 Kondapally Kalyan <kalyan.kondapa...@intel.com>
[EFL][WebGL] Minor Refactoring in GraphicsContext3DEfl.
Modified: trunk/Source/WebCore/editing/VisiblePosition.cpp (137212 => 137213)
--- trunk/Source/WebCore/editing/VisiblePosition.cpp 2012-12-10 23:06:42 UTC (rev 137212)
+++ trunk/Source/WebCore/editing/VisiblePosition.cpp 2012-12-10 23:30:36 UTC (rev 137213)
@@ -145,7 +145,7 @@
if (box->isLeftToRightDirection() ? offset < caretMinOffset : offset > caretMaxOffset) {
// Overshot to the left.
- InlineBox* prevBox = box->prevLeafChild();
+ InlineBox* prevBox = box->prevLeafChildIgnoringLineBreak();
if (!prevBox) {
Position positionOnLeft = primaryDirection == LTR ? previousVisuallyDistinctCandidate(m_deepPosition) : nextVisuallyDistinctCandidate(m_deepPosition);
if (positionOnLeft.isNull())
@@ -310,7 +310,7 @@
if (box->isLeftToRightDirection() ? offset > caretMaxOffset : offset < caretMinOffset) {
// Overshot to the right.
- InlineBox* nextBox = box->nextLeafChild();
+ InlineBox* nextBox = box->nextLeafChildIgnoringLineBreak();
if (!nextBox) {
Position positionOnRight = primaryDirection == LTR ? nextVisuallyDistinctCandidate(m_deepPosition) : previousVisuallyDistinctCandidate(m_deepPosition);
if (positionOnRight.isNull())
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo/webkit-changes
