Commit 7f4659e6 authored by harrison's avatar harrison
Browse files

LayoutTests:

        Reviewed by John Sullivan.

        <rdar://problem/4598149> Deleting the contents of a DOMRange and then inserting a node into it crashes in WebCore::Font::canUseGlyphCache

        * fast/dom/delete-contents-expected.checksum: Added.
        * fast/dom/delete-contents-expected.png: Added.
        * fast/dom/delete-contents-expected.txt: Added.
        * fast/dom/delete-contents.html: Added.

WebCore:

        Reviewed by John Sullivan.

        <rdar://problem/4598149> Deleting the contents of a DOMRange and then inserting a node into it crashes in WebCore::Font::canUseGlyphCache

        Test: fast/dom/delete-contents.html
        
        * dom/Range.cpp:
        (WebCore::Range::processContents):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@15270 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent e775cf78
2006-07-09 David Harrison <harrison@apple.com>
Reviewed by John Sullivan.
<rdar://problem/4598149> Deleting the contents of a DOMRange and then inserting a node into it crashes in WebCore::Font::canUseGlyphCache
* fast/dom/delete-contents-expected.checksum: Added.
* fast/dom/delete-contents-expected.png: Added.
* fast/dom/delete-contents-expected.txt: Added.
* fast/dom/delete-contents.html: Added.
2006-07-09 David Kilzer <ddkilzer@kilzer.net>
 
Reviewed by Darin.
853de00567d121bea0b7bece66a5d61c
\ No newline at end of file
EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
layer at (0,0) size 800x600
RenderView at (0,0) size 800x600
layer at (0,0) size 800x600
RenderBlock {HTML} at (0,0) size 800x600
RenderBody {BODY} at (8,8) size 784x584
RenderBlock {DIV} at (0,0) size 784x0
RenderBlock (anonymous) at (0,0) size 784x0
RenderText {#text} at (0,0) size 0x0
RenderBlock {DIV} at (0,0) size 784x0
selection start: position 0 of child 0 {#text} of child 0 {DIV} of child 0 {BODY} of child 0 {HTML} of document
selection end: position 5 of child 0 {#text} of child 0 {DIV} of child 0 {BODY} of child 0 {HTML} of document
<!-- This test was derived from a real case inside the Mail application, bug 4598149-->
<div id="mydiv">01234</div>
<script>
var txt = document.getElementById("mydiv").firstChild;
window.getSelection().setBaseAndExtent(txt, 0, txt, 5)
var r = window.getSelection().getRangeAt(0);
r.deleteContents();
r.insertNode(document.createElement("div"));
</script>
2006-07-09 David Harrison <harrison@apple.com>
Reviewed by John Sullivan.
<rdar://problem/4598149> Deleting the contents of a DOMRange and then inserting a node into it crashes in WebCore::Font::canUseGlyphCache
Test: fast/dom/delete-contents.html
* dom/Range.cpp:
(WebCore::Range::processContents):
2006-07-09 Darin Adler <darin@apple.com>
- another round of renaming; and KWQ is dead
......
......@@ -544,8 +544,10 @@ PassRefPtr<DocumentFragment> Range::processContents ( ActionType action, Excepti
c->deleteData(0, m_startOffset, ec);
fragment->appendChild(c.release(), ec);
}
if (action == EXTRACT_CONTENTS || action == DELETE_CONTENTS)
if (action == EXTRACT_CONTENTS || action == DELETE_CONTENTS) {
static_cast<CharacterData*>(m_startContainer.get())->deleteData(m_startOffset,m_endOffset-m_startOffset,ec);
m_startContainer->document()->updateLayout();
}
}
else if (m_startContainer->nodeType() == Node::PROCESSING_INSTRUCTION_NODE) {
// ### operate just on data ?
......@@ -602,9 +604,11 @@ PassRefPtr<DocumentFragment> Range::processContents ( ActionType action, Excepti
c->deleteData(0, m_startOffset, ec);
leftContents = c.release();
}
if (action == EXTRACT_CONTENTS || action == DELETE_CONTENTS)
if (action == EXTRACT_CONTENTS || action == DELETE_CONTENTS) {
static_cast<CharacterData*>(m_startContainer.get())->deleteData(
m_startOffset, static_cast<CharacterData*>(m_startContainer.get())->length() - m_startOffset, ec);
m_startContainer->document()->updateLayout();
}
}
else if (m_startContainer->nodeType() == Node::PROCESSING_INSTRUCTION_NODE) {
// ### operate just on data ?
......@@ -664,8 +668,10 @@ PassRefPtr<DocumentFragment> Range::processContents ( ActionType action, Excepti
c->deleteData(m_endOffset, static_cast<CharacterData*>(m_endContainer.get())->length() - m_endOffset, ec);
rightContents = c;
}
if (action == EXTRACT_CONTENTS || action == DELETE_CONTENTS)
if (action == EXTRACT_CONTENTS || action == DELETE_CONTENTS) {
static_cast<CharacterData*>(m_endContainer.get())->deleteData(0, m_endOffset, ec);
m_startContainer->document()->updateLayout();
}
}
else if (m_startContainer->nodeType() == Node::PROCESSING_INSTRUCTION_NODE) {
// ### operate just on data ?
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment