Commit 7f0dffc7 authored by morrita@google.com's avatar morrita@google.com
Browse files

2011-05-10 MORITA Hajime <morrita@google.com>

        Reviewed by Kent Tamura.

        Crashes if the document inside iframe is removed during pasting some text into it.
        https://bugs.webkit.org/show_bug.cgi?id=60534

        * editing/pasteboard/paste-removing-iframe-expected.txt: Added.
        * editing/pasteboard/paste-removing-iframe.html: Added.
        * editing/pasteboard/resources/paste-removing-iframe-child.html: Added.
2011-05-10  MORITA Hajime  <morrita@google.com>

        Reviewed by Kent Tamura.

        Crashes if the document inside iframe is removed during pasting some text into it.
        https://bugs.webkit.org/show_bug.cgi?id=60534

        Added missing null check.

        Test: editing/pasteboard/paste-removing-iframe.html

        * editing/Editor.cpp:
        (WebCore::Editor::shouldChangeSelection):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@86311 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent 9260236f
2011-05-10 MORITA Hajime <morrita@google.com>
Reviewed by Kent Tamura.
Crashes if the document inside iframe is removed during pasting some text into it.
https://bugs.webkit.org/show_bug.cgi?id=60534
* editing/pasteboard/paste-removing-iframe-expected.txt: Added.
* editing/pasteboard/paste-removing-iframe.html: Added.
* editing/pasteboard/resources/paste-removing-iframe-child.html: Added.
2011-05-11 MORITA Hajime <morrita@google.com>
 
Reviewed by Kent Tamura.
<html>
<head>
<script>
if (window.layoutTestController) {
layoutTestController.dumpAsText();
layoutTestController.waitUntilDone();
}
function test()
{
var toRemove = document.getElementById("child");
var childDocument = toRemove.contentDocument;
var textarea = childDocument.getElementById("target");
textarea.addEventListener("input", function(evt) {
toRemove.parentNode.removeChild(toRemove);
if (window.layoutTestController)
window.layoutTestController.notifyDone();
});
var selection = childDocument.getSelection();
var data = childDocument.getElementById("data");
selection.selectAllChildren(data);
childDocument.execCommand("copy");
textarea.select();
childDocument.execCommand("paste");
}
</script>
</head>
<body>
<!--
-- This test removes an iframe with editable content
-- during actually editing that editable text by handling DOM input event.
-- WebKit should not crash even after this brutal removal.
-->
<h1>PASS</h1>
<iframe id="child" onload="test()" src="resources/paste-removing-iframe-child.html" />
</body>
</html>
<html>
<body>
<textarea id="target"></textarea>
<div id="data" contentEditable>Hello</div>
</body>
</html>
2011-05-10 MORITA Hajime <morrita@google.com>
Reviewed by Kent Tamura.
Crashes if the document inside iframe is removed during pasting some text into it.
https://bugs.webkit.org/show_bug.cgi?id=60534
Added missing null check.
Test: editing/pasteboard/paste-removing-iframe.html
* editing/Editor.cpp:
(WebCore::Editor::shouldChangeSelection):
2011-05-11 Brian Salomon <bsalomon@google.com>
 
Reviewed by Eric Seidel.
......@@ -2787,7 +2787,7 @@ IntRect Editor::firstRectForRange(Range* range) const
bool Editor::shouldChangeSelection(const VisibleSelection& oldSelection, const VisibleSelection& newSelection, EAffinity affinity, bool stillSelecting) const
{
return client()->shouldChangeSelectedRange(oldSelection.toNormalizedRange().get(), newSelection.toNormalizedRange().get(), affinity, stillSelecting);
return client() && client()->shouldChangeSelectedRange(oldSelection.toNormalizedRange().get(), newSelection.toNormalizedRange().get(), affinity, stillSelecting);
}
void Editor::computeAndSetTypingStyle(CSSStyleDeclaration* style, EditAction editingAction)
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment