• justing's avatar
    WebCore: · 4855c4f9
    justing authored
            Reviewed by Adele.
    
            <rdar://problem/5156801> REGRESSION: Crash at DeleteSelectionCommand::doApply() when deleting table content
    
            * editing/DeleteSelectionCommand.cpp:
            (WebCore::DeleteSelectionCommand::handleGeneralDelete): Use a RefPtr
            for node.  If the node to be removed contains the selection, and if
            the next node to be removed (nextNode) is inside the deletion UI,
            removing node will remove nextNode from the document.  nextNode is
            a RefPtr, but node isn't and when nextNode falls out of scope the node
            that node points to will be destroyed and we'll end up using a stale pointer.
            Long term we should probably just disable the deletion UI before editing 
            operations because the undo of the removal of node in the situation 
            described above relies on the presence of the deletion UI, but it isn't 
            present because its added and removed in a non-undoable way.
    
    LayoutTests:
    
            Reviewed by Adele.
            
            <rdar://problem/5156801> REGRESSION: Crash at DeleteSelectionCommand::doApply() when deleting table content
    
            * editing/deleting/5156801-2.html: Added.
            * platform/mac/editing/deleting: Added.
            * platform/mac/editing/deleting/5156801-2-expected.checksum: Added.
            * platform/mac/editing/deleting/5156801-2-expected.png: Added.
            * platform/mac/editing/deleting/5156801-2-expected.txt: Added.
    
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@25203 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    4855c4f9
5156801-2-expected.txt 1.09 KB