Commit 395a18e8 authored by justing's avatar justing

LayoutTests:

        Reviewed by John.
        
        <rdar://problem/5290534> Crash RenderTextControl::calcHeight() after deleting text in a search field

        Demonstrates the bug:
        * editing/deleting/5290534-expected.txt: Added.
        * editing/deleting/5290534.html: Added.

        Fixed a bug (an extra br was inserted) and removed a FIXME:
        * editing/deleting/4845371-expected.checksum:
        * editing/deleting/4845371-expected.png:
        * editing/deleting/4845371-expected.txt:
        * editing/deleting/4845371.html:
        
        Removed an unrendered br that was being incorrectly inserted:
        * editing/deleting/5126166-expected.txt:

WebCore:

        Reviewed by John.

        <rdar://problem/5290534> Crash at RenderTextControl::calcHeight() after deleting text in a search field
        
        Editing removed a node that was part of a search field's internal
        structure that should not be removed.

        * editing/DeleteSelectionCommand.cpp:
        (WebCore::DeleteSelectionCommand::handleGeneralDelete): If the
        selection to delete ends at [container, x], where x is the number
        of children in container, don't remove container.  Special case
        code elsewhere in this function will remove it if necessary.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@23787 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent 647af262
2007-06-26 Justin Garcia <justin.garcia@apple.com>
Reviewed by John.
<rdar://problem/5290534> Crash RenderTextControl::calcHeight() after deleting text in a search field
Demonstrates the bug:
* editing/deleting/5290534-expected.txt: Added.
* editing/deleting/5290534.html: Added.
Fixed a bug (an extra br was inserted) and removed a FIXME:
* editing/deleting/4845371-expected.checksum:
* editing/deleting/4845371-expected.png:
* editing/deleting/4845371-expected.txt:
* editing/deleting/4845371.html:
Removed an unrendered br that was being incorrectly inserted:
* editing/deleting/5126166-expected.txt:
2007-06-25 Sam Weinig <sam@webkit.org>
Reviewed by Maciej.
774af8ecc2ec6463f3c453f0044f6acd
\ No newline at end of file
fc01f7cdc3dcd8d9ec9d95add16456a2
\ No newline at end of file
......@@ -14,22 +14,16 @@ layer at (0,0) size 800x600
layer at (0,0) size 800x600
RenderBlock {HTML} at (0,0) size 800x600
RenderBody {BODY} at (8,8) size 784x584
RenderBlock {P} at (0,0) size 784x36
RenderText {#text} at (0,0) size 386x18
text run at (0,0) width 386: "This tests for a crasher when deleting contents of a table cell. "
RenderInline {B} at (0,0) size 741x36
RenderText {#text} at (386,0) size 741x36
text run at (386,0) width 105: "There is a bug. "
text run at (491,0) width 250: "A br is inserted in the table cell that's"
text run at (0,18) width 84: "emptied out."
RenderBlock {DIV} at (0,52) size 784x42
RenderTable {TABLE} at (0,0) size 32x42
RenderTableSection {TBODY} at (0,0) size 32x42
RenderTableRow {TR} at (0,2) size 32x38
RenderTableCell {TD} at (2,2) size 2x38 [r=0 c=0 rs=1 cs=1]
RenderBlock {P} at (0,0) size 784x18
RenderText {#text} at (0,0) size 382x18
text run at (0,0) width 382: "This tests for a crasher when deleting contents of a table cell."
RenderBlock {DIV} at (0,34) size 784x24
RenderTable {TABLE} at (0,0) size 32x24
RenderTableSection {TBODY} at (0,0) size 32x24
RenderTableRow {TR} at (0,2) size 32x20
RenderTableCell {TD} at (2,2) size 2x20 [r=0 c=0 rs=1 cs=1]
RenderBR {BR} at (1,1) size 0x18
RenderBR {BR} at (1,19) size 0x18
RenderTableCell {TD} at (6,11) size 24x20 [r=0 c=1 rs=1 cs=1]
RenderTableCell {TD} at (6,2) size 24x20 [r=0 c=1 rs=1 cs=1]
RenderText {#text} at (1,1) size 22x18
text run at (1,1) width 22: "baz"
caret: position 0 of child 0 {BR} of child 0 {TD} of child 0 {TR} of child 0 {TBODY} of child 0 {TABLE} of child 2 {DIV} of child 0 {BODY} of child 0 {HTML} of document
<p>This tests for a crasher when deleting contents of a table cell. <b>There is a bug. A br is inserted in the table cell that's emptied out.</b></p>
<p>This tests for a crasher when deleting contents of a table cell.</p>
<div id="div" contenteditable="true"><table><tr><td>foo <a href="http://www.google.com/">bar</a></td><td>baz</td></tr></table></div>
<script src="../editing.js"></script>
......
......@@ -18,8 +18,7 @@ layer at (0,0) size 800x600
RenderTable {TABLE} at (0,28) size 351x28 [border: (1px outset #808080)]
RenderTableSection {TBODY} at (1,1) size 349x26
RenderTableRow {TR} at (0,2) size 349x22
RenderTableCell {TD} at (2,2) size 4x22 [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=1]
RenderBR {BR} at (2,2) size 0x18
RenderTableCell {TD} at (2,11) size 4x4 [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=1]
RenderTableCell {TD} at (8,2) size 339x22 [border: (1px inset #808080)] [r=0 c=1 rs=1 cs=1]
RenderText {#text} at (2,2) size 335x18
text run at (2,2) width 335: "There should be one empty cell to the left of this one."
......
This tests for a crash when adding/removing content from a search field that is inside an editable region.
Success! Test successfully removed text from the search field.
<p>This tests for a crash when adding/removing content from a search field that is inside an editable region.</p>
<div contenteditable="true"><input id="search" type="search"></div>
<ul id="console"></ul>
<script>
function log(msg)
{
li = document.createElement("li");
li.appendChild(document.createTextNode(msg));
document.getElementById("console").appendChild(li);
}
if (window.layoutTestController)
window.layoutTestController.dumpAsText();
var search = document.getElementById("search");
search.setSelectionRange(0, 0);
document.execCommand("InsertText", false, "x");
if (search.value != "x")
log("Failure: text wasn't added to the search field.");
document.execCommand("Delete");
if (search.value == "")
log("Success! Test successfully removed text from the search field.");
</script>
2007-06-26 Justin Garcia <justin.garcia@apple.com>
Reviewed by John.
<rdar://problem/5290534> Crash at RenderTextControl::calcHeight() after deleting text in a search field
Editing removed a node that was part of a search field's internal
structure that should not be removed.
* editing/DeleteSelectionCommand.cpp:
(WebCore::DeleteSelectionCommand::handleGeneralDelete): If the
selection to delete ends at [container, x], where x is the number
of children in container, don't remove container. Special case
code elsewhere in this function will remove it if necessary.
2007-06-25 Sam Weinig <sam@webkit.org>
Reviewed by Maciej.
......@@ -410,11 +410,8 @@ void DeleteSelectionCommand::handleGeneralDelete()
}
if (m_downstreamEnd.node() != startNode && !m_upstreamStart.node()->isDescendantOf(m_downstreamEnd.node()) && m_downstreamEnd.node()->inDocument() && m_downstreamEnd.offset() >= m_downstreamEnd.node()->caretMinOffset()) {
if (m_downstreamEnd.offset() >= maxDeepOffset(m_downstreamEnd.node())) {
// need to delete whole node
// we can get here if this is the last node in the block
// remove an ancestor of m_downstreamEnd.node(), and thus m_downstreamEnd.node() itself
// FIXME: Shouldn't remove m_downstreamEnd.node() if its offsets refer to children.
if (m_downstreamEnd.offset() >= maxDeepOffset(m_downstreamEnd.node()) && !canHaveChildrenForEditing(m_downstreamEnd.node())) {
// The node itself is fully selected, not just its contents. Delete it.
removeNode(m_downstreamEnd.node());
} else {
if (m_downstreamEnd.node()->isTextNode()) {
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment