Commit 370e60e8 authored by justing's avatar justing

LayoutTests:

        Reviewed by darin
        
        <rdar://problem/5168598> Crash when deleting a link inside an input field

        * editing/deleting/5168598-expected.checksum: Added.
        * editing/deleting/5168598-expected.png: Added.
        * editing/deleting/5168598-expected.txt: Added.
        * editing/deleting/5168598.html: Added.

WebCore:

        Reviewed by darin

        <rdar://problem/5168598> 
        Crash when deleting a link inside an input field
        
        Deletion code tries to update one of its positions to keep 
        it valid and nullifies it.  Later in mergeParagraphs we try 
        to find out if it's valid by checking to see if it's still in 
        the document and crash.
        
        The fix is just to not bother keeping the position, 
        m_upstreamStart, valid, since after the point in the code 
        under examination, it doesn't need to be valid anymore.  
        Besides, code to update DeleteSelectionCommand's positions 
        should go in the functions that handle the content removal 
        that might invalid them (there are already FIXMEs about this).
        
        Also, users shouldn't be able to insert links (or any rich content)
        into plaintext-only regions like text fields, even if those
        text fields are inside richly editable regions.  This is a 
        separate bug and is filed as 5171552.

        * editing/DeleteSelectionCommand.cpp:
        (WebCore::DeleteSelectionCommand::handleGeneralDelete): Don't
        bother updating m_upstreamStart.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@21195 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent ce7848e3
2007-04-30 Justin Garcia <justin.garcia@apple.com>
Reviewed by darin
<rdar://problem/5168598> Crash when deleting a link inside an input field
* editing/deleting/5168598-expected.checksum: Added.
* editing/deleting/5168598-expected.png: Added.
* editing/deleting/5168598-expected.txt: Added.
* editing/deleting/5168598.html: Added.
2007-04-29 Mitz Pettel <mitz@webkit.org>
Reviewed by Dave Hyatt.
76ad7cc4f8cf95d78dab985bc36d383d
\ No newline at end of file
layer at (0,0) size 800x600
RenderView at (0,0) size 800x600
layer at (0,0) size 800x600
RenderBlock {HTML} at (0,0) size 800x600
RenderBody {BODY} at (8,8) size 784x584
RenderBlock {P} at (0,0) size 784x54
RenderText {#text} at (0,0) size 737x36
text run at (0,0) width 737: "This tests for a crash when deleting a link inside a text field inside a completely editable document. You shouldn't see"
text run at (0,18) width 185: "anything inside the text field.'"
RenderInline {B} at (0,0) size 767x36
RenderText {#text} at (185,18) size 767x36
text run at (185,18) width 582: "We probably shouldn't let users add rich content to text fields even if they are in richly"
text run at (0,36) width 114: "editable regions.'"
RenderBlock (anonymous) at (0,70) size 784x23
RenderTextControl {INPUT} at (2,2) size 148x19 [bgcolor=#FFFFFF] [border: (2px inset #000000)]
RenderText {#text} at (0,0) size 0x0
RenderText {#text} at (0,0) size 0x0
RenderText {#text} at (0,0) size 0x0
layer at (13,83) size 142x13
RenderBlock {DIV} at (3,3) size 142x13
RenderInline {FONT} at (0,0) size 0x13
RenderInline {SPAN} at (0,0) size 0x13
RenderBR {BR} at (1,0) size 0x13
caret: position 0 of child 0 {BR} of child 0 {SPAN} of child 0 {FONT} of child 0 {DIV} of child 3 {INPUT} of child 0 {BODY} of child 0 {HTML} of document
<body>
<p>This tests for a crash when deleting a link inside a text field inside a completely editable document. You shouldn't see anything inside the text field.'<b>We probably shouldn't let users add rich content to text fields even if they are in richly editable regions.'</b></p>
<input type="text" id="textfield">
<script>
document.designMode = "on";
var textfield = document.getElementById("textfield");
textfield.setSelectionRange(0, 0);
document.execCommand("CreateLink", false, "http://www.google.com/")
document.execCommand("Delete");
</script>
</body>
2007-04-30 Justin Garcia <justin.garcia@apple.com>
Reviewed by darin
<rdar://problem/5168598>
Crash when deleting a link inside an input field
Deletion code tries to update one of its positions to keep
it valid and nullifies it. Later in mergeParagraphs we try
to find out if it's valid by checking to see if it's still in
the document and crash.
The fix is just to not bother keeping the position,
m_upstreamStart, valid, since after the point in the code
under examination, it doesn't need to be valid anymore.
Besides, code to update DeleteSelectionCommand's positions
should go in the functions that handle the content removal
that might invalid them (there are already FIXMEs about this).
Also, users shouldn't be able to insert links (or any rich content)
into plaintext-only regions like text fields, even if those
text fields are inside richly editable regions. This is a
separate bug and is filed as 5171552.
* editing/DeleteSelectionCommand.cpp:
(WebCore::DeleteSelectionCommand::handleGeneralDelete): Don't
bother updating m_upstreamStart.
2007-04-30 Patti Hoa <patti@apple.com>
Reviewed by Dave Hyatt.
......@@ -406,12 +406,7 @@ void DeleteSelectionCommand::handleGeneralDelete()
// need to delete whole node
// we can get here if this is the last node in the block
// remove an ancestor of m_downstreamEnd.node(), and thus m_downstreamEnd.node() itself
if (!m_upstreamStart.node()->inDocument() ||
m_upstreamStart.node() == m_downstreamEnd.node() ||
m_upstreamStart.node()->isDescendantOf(m_downstreamEnd.node())) {
m_upstreamStart = Position(m_downstreamEnd.node()->parentNode(), m_downstreamEnd.node()->nodeIndex());
}
// FIXME: Shouldn't remove m_downstreamEnd.node() if its offsets refer to children.
removeNode(m_downstreamEnd.node());
} else {
if (m_downstreamEnd.node()->isTextNode()) {
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment