Commit 2bdb03e0 authored by justing's avatar justing

LayoutTests:

        Reviewed by sullivan
        
        <rdar://problem/4845371>
        In Mail, a crash occurs at WebCore::Node::traverseNextNode() when cutting selected text from a HTML message

        * editing/deleting/4845371-expected.checksum: Added.
        * editing/deleting/4845371-expected.png: Added.
        * editing/deleting/4845371-expected.txt: Added.
        * editing/deleting/4845371.html: Added.

WebCore:

        Reviewed by sullivan
        
        <rdar://problem/4845371>
        In Mail, a crash occurs at WebCore::Node::traverseNextNode() when cutting selected text from a HTML message
        
        * editing/DeleteSelectionCommand.cpp:
        (WebCore::DeleteSelectionCommand::initializeStartEnd): The start/end were
        being inflated even when they were the start/end of a partially selected
        special element.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@17936 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent f26644b7
2006-11-29 Justin Garcia <justin.garcia@apple.com>
Reviewed by sullivan
<rdar://problem/4845371>
In Mail, a crash occurs at WebCore::Node::traverseNextNode() when cutting selected text from a HTML message
* editing/deleting/4845371-expected.checksum: Added.
* editing/deleting/4845371-expected.png: Added.
* editing/deleting/4845371-expected.txt: Added.
* editing/deleting/4845371.html: Added.
2006-11-28 David Harrison <harrison@apple.com>
Reviewed by Adele.
774af8ecc2ec6463f3c453f0044f6acd
\ No newline at end of file
EDITING DELEGATE: shouldBeginEditingInDOMRange:range from 0 of DIV > BODY > HTML > #document to 1 of DIV > BODY > HTML > #document
EDITING DELEGATE: webViewDidBeginEditing:WebViewDidBeginEditingNotification
EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
EDITING DELEGATE: shouldDeleteDOMRange:range from 0 of #text > TD > TR > TBODY > TABLE > DIV > BODY > HTML > #document to 3 of #text > A > TD > TR > TBODY > TABLE > DIV > BODY > HTML > #document
EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
EDITING DELEGATE: shouldChangeSelectedDOMRange:(null) toDOMRange:range from 0 of TD > TR > TBODY > TABLE > DIV > BODY > HTML > #document to 0 of TD > TR > TBODY > TABLE > DIV > BODY > HTML > #document affinity:NSSelectionAffinityDownstream stillSelecting:FALSE
EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
layer at (0,0) size 800x600
RenderView at (0,0) size 800x600
layer at (0,0) size 800x600
RenderBlock {HTML} at (0,0) size 800x600
RenderBody {BODY} at (8,8) size 784x584
RenderBlock {P} at (0,0) size 784x36
RenderText {#text} at (0,0) size 386x18
text run at (0,0) width 386: "This tests for a crasher when deleting contents of a table cell. "
RenderInline {B} at (0,0) size 741x36
RenderText {#text} at (386,0) size 741x36
text run at (386,0) width 105: "There is a bug. "
text run at (491,0) width 250: "A br is inserted in the table cell that's"
text run at (0,18) width 84: "emptied out."
RenderBlock {DIV} at (0,52) size 784x42
RenderTable {TABLE} at (0,0) size 32x42
RenderTableSection {TBODY} at (0,0) size 32x42
RenderTableRow {TR} at (0,2) size 32x38
RenderTableCell {TD} at (2,2) size 2x38 [r=0 c=0 rs=1 cs=1]
RenderBR {BR} at (1,1) size 0x18
RenderBR {BR} at (1,19) size 0x18
RenderTableCell {TD} at (6,11) size 24x20 [r=0 c=1 rs=1 cs=1]
RenderText {#text} at (1,1) size 22x18
text run at (1,1) width 22: "baz"
caret: position 0 of child 0 {BR} of child 0 {TD} of child 0 {TR} of child 0 {TBODY} of child 0 {TABLE} of child 2 {DIV} of child 0 {BODY} of child 0 {HTML} of document
<p>This tests for a crasher when deleting contents of a table cell. <b>There is a bug. A br is inserted in the table cell that's emptied out.</b></p>
<div id="div" contenteditable="true"><table><tr><td>foo <a href="http://www.google.com/">bar</a></td><td>baz</td></tr></table></div>
<script type="Javascript" src="../editing.js"></script>
<script>
runEditingTest();
function editingTest() {
var div = document.getElementById("div");
var sel = window.getSelection();
sel.setPosition(div, 0);
moveSelectionForwardByCharacterCommand();
extendSelectionForwardByWordCommand();
extendSelectionForwardByWordCommand();
deleteCommand();
}
</script>
2006-11-29 Justin Garcia <justin.garcia@apple.com>
Reviewed by sullivan
<rdar://problem/4845371>
In Mail, a crash occurs at WebCore::Node::traverseNextNode() when cutting selected text from a HTML message
* editing/DeleteSelectionCommand.cpp:
(WebCore::DeleteSelectionCommand::initializeStartEnd): The start/end were
being inflated even when they were the start/end of a partially selected
special element.
2006-11-29 Anders Carlsson <acarlsson@apple.com>
Reviewed by Oliver.
......@@ -97,8 +97,18 @@ void DeleteSelectionCommand::initializeStartEnd()
if (!startSpecialContainer || !endSpecialContainer)
break;
start = s;
end = e;
if (startSpecialContainer->isDescendantOf(endSpecialContainer))
// Don't adjust the end yet, it is the end of a special element that contains the start
// special element (which may or may not be fully selected).
start = s;
else if (endSpecialContainer->isDescendantOf(startSpecialContainer))
// Don't adjust the start yet, it is the start of a special element that contains the end
// special element (which may or may not be fully selected).
end = e;
else {
start = s;
end = e;
}
}
m_upstreamStart = start.upstream();
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment