Commit 78eddf96 authored by dglazkov@chromium.org's avatar dglazkov@chromium.org

WebCore:

2009-03-03  Scott Violet  <sky@google.com>

        Reviewed by Eric Seidel.

        https://bugs.webkit.org/show_bug.cgi?id=24325
        Crash on replacing document contents during drop.

        Makes sure a node is in the document during a move before using it.

        Test: fast/events/crash-on-mutate-during-drop.html

        * editing/MoveSelectionCommand.cpp:
        (WebCore::MoveSelectionCommand::doApply):

LayoutTests:

2009-03-03  Scott Violet  <sky@google.com>

        Reviewed by Eric Seidel.

        https://bugs.webkit.org/show_bug.cgi?id=24325
        Crash on replacing document contents during drop

        Makes sure we don't crash during dnd with DOM mutation event listener
        that mutates the document on drop.

        * fast/events/crash-on-mutate-during-drop-expected.txt: Added.
        * fast/events/crash-on-mutate-during-drop.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@41403 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent 0ad2e88f
2009-03-03 Scott Violet <sky@google.com>
Reviewed by Eric Seidel.
https://bugs.webkit.org/show_bug.cgi?id=24325
Crash on replacing document contents during drop
Makes sure we don't crash during dnd with DOM mutation event listener
that mutates the document on drop.
* fast/events/crash-on-mutate-during-drop-expected.txt: Added.
* fast/events/crash-on-mutate-during-drop.html: Added.
2009-03-03 Brady Eidson <beidson@apple.com>
Reviewed by Darin Adler
......
<html>
<head>
<script>
function foo() {
if (event.type == "DOMNodeInserted" && event.target.nodeName == "BR")
document.body.innerHTML = "PASSED";
}
function runTest() {
if (!window.layoutTestController)
return;
window.layoutTestController.dumpAsText();
document.body.addEventListener("DOMNodeInserted", function() { foo() }, true);
// Select the element 'dragSource'.
var selection = window.getSelection();
var range = document.createRange();
range.selectNode(document.getElementById("dragSource"));
selection.addRange(range);
// Drag the source text to the target text.
var source = document.getElementById('dragSource');
var target = document.getElementById('dragTarget');
eventSender.mouseMoveTo(source.offsetLeft + 2, source.offsetTop + 2);
eventSender.mouseDown();
eventSender.leapForward(500);
eventSender.mouseMoveTo(target.offsetLeft + target.offsetWidth / 2,
target.offsetTop + target.offsetHeight / 2);
eventSender.mouseUp();
}
</script>
</head>
<body contenteditable="true" onload="runTest()">
<p>This test tests for a crash when a DOM mutation event listener
modifies the text during a drop. If the test doesn't crash, all is good.
<p id="dragSource">drag source text
<p id="dragTarget">drag dest text
</body>
</html>
\ No newline at end of file
2009-03-03 Scott Violet <sky@google.com>
Reviewed by Eric Seidel.
https://bugs.webkit.org/show_bug.cgi?id=24325
Crash on replacing document contents during drop.
Makes sure a node is in the document during a move before using it.
Test: fast/events/crash-on-mutate-during-drop.html
* editing/MoveSelectionCommand.cpp:
(WebCore::MoveSelectionCommand::doApply):
2009-03-03 Jungshik Shin <jshin@chromium.org>
Reviewed by Eric Seidel.
......@@ -70,6 +70,10 @@ void MoveSelectionCommand::doApply()
pos = endingSelection().start();
setEndingSelection(VisibleSelection(pos, endingSelection().affinity()));
if (!positionNode->inDocument()) {
// Document was modified out from under us.
return;
}
applyCommandToComposite(ReplaceSelectionCommand::create(positionNode->document(), m_fragment, true, m_smartMove));
}
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment