-
justing authored
Reviewed by darin <rdar://problem/5142012> GoogleDocs: Crash at WebCore::Range::startPosition() when creating a list from a link Tests the change to pushAnchorElementDown, where we remove the anchor element that has had copies of it pushed down: * editing/execCommand/5142012-1-expected.checksum: Added. * editing/execCommand/5142012-1-expected.png: Added. * editing/execCommand/5142012-1-expected.txt: Added. * editing/execCommand/5142012-1.html: Added. Demonstrates the crash (fixed by adding nil-checks to moveParagraphs): * editing/execCommand/5142012-2-expected.checksum: Added. * editing/execCommand/5142012-2-expected.png: Added. * editing/execCommand/5142012-2-expected.txt: Added. * editing/execCommand/5142012-2.html: Added. Tests the changes to positionAvoidingSpecialElementBoundary, where we push down anchors before we avoid them so that we don't also avoid structural elements like lists and paragraphs: * editing/execCommand/5142012-3-expected.checksum: Added. * editing/execCommand/5142012-3-expected.png: Added. * editing/execCommand/5142012-3-expected.txt: Added. * editing/execCommand/5142012-3.html: Added. WebCore: Reviewed by darin <rdar://problem/5142012> GoogleDocs: Crash at WebCore::Range::startPosition() when creating a list from a link List creation uses moveParagraphs to push content into list items. Its fragment creation (using createMarkup) incorrectly uses regular spaces instead of nbsps for spaces that were rendered (11475), which causes spaces to be collapsed during the move operation. This results in a call to rangeFromLocationAndLength with a location past the end of the document. We use the result from rangeFromLocationAndLength (null) and crash. Also when moveParagraphs tries to push content into a list item surrounded by an anchor, it fails because positionAvoidingSpecialElementBoundary avoids the anchor, which also avoids the list item. This was fixed by pushing down anchors before avoiding them. * editing/CompositeEditCommand.cpp: (WebCore::CompositeEditCommand::pushAnchorElementDown): Remove the old anchor after we push down clones of it, this is what callers expect. (WebCore::CompositeEditCommand::pushPartiallySelectedAnchorElementsDown): Call the new enclosingAnchorElement, that takes in a position instead of a node. (WebCore::CompositeEditCommand::moveParagraphs): If spaces collapsed as a result of the move, rangeFromLocationAndLength can return null, bail and don't try to preserve the selection in that case. (WebCore::CompositeEditCommand::positionAvoidingSpecialElementBoundary): Moved from htmlediting.cpp. Make sure anchors are pushed down before avoiding them so that we don't also avoid structural elements like lists and blocks. * editing/CompositeEditCommand.h: * editing/TypingCommand.cpp: Moved isFirst/LastPositionBefore/AfterTable to htmlediting.cpp. * editing/htmlediting.cpp: Moved positionAvoidingSpecialElementBoundary so that it could call pushAnchorElementDown. (WebCore::isFirstPositionAfterTable): Moved here. (WebCore::isLastPositionBeforeTable): Moved here. (WebCore::enclosingAnchorElement): Moved here. (WebCore::enclosingListChild): Removed an extraneous space. * editing/htmlediting.h: git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20958 268f45cc-cd09-0410-ab3c-d52691b4dbfc
5a39d330