2010-12-03 Ryosuke Niwa <rniwa@webkit.org>
authorrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 3 Dec 2010 19:26:22 +0000 (19:26 +0000)
committerrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 3 Dec 2010 19:26:22 +0000 (19:26 +0000)
commit7763bc737586aaf2acbf5f71d6042d58ed5f49e3
tree4cedcbae927440c7ff5a90d66d2bc8825a804406
parenteb963150174dd844f48d314c345bf8018dbf53e9
2010-12-03  Ryosuke Niwa  <rniwa@webkit.org>

        Reviewed by Darin Adler.

        REGRESSION: Crash when deleting text after textarea's value is modified on input event
        https://bugs.webkit.org/show_bug.cgi?id=49962

        The crash was caused by TypingCommand::deleteKeyPressed's reusing a typing command for
        textarea's shadow DOM after its input event handler rewrote the value set by the typing command.
        Because the reused typing command's ending selection was pointing at a shadow node
        that has been detached from the document when the event handler set the new value,
        rootEditableElement of the ending selection was null and caused the crash.

        Fixed the bug by updating the ending selection of the last typing command when it differsfrom
        that of the current selection held by the SelectionController in TypingCommand::deleteKeyPressed.
        Also fixed similar bugs in forwardDeleteKeyPressed and insertText, and insertTextRunWithoutNewlines.

        Tests: editing/input/set-value-on-input-and-delete.html
               editing/input/set-value-on-input-and-forward-delete.html
               editing/input/set-value-on-input-and-type-input.html
               editing/input/set-value-on-input-and-type-textarea.html

        * editing/InsertTextCommand.h: Added TypingCommand as a friend because it needs to update selection.
        * editing/TypingCommand.cpp:
        (WebCore::TypingCommand::deleteKeyPressed): Updates the last typing command's selection as needed.
        (WebCore::TypingCommand::forwardDeleteKeyPressed): Ditto.
        (WebCore::TypingCommand::insertText): Ditto.
        (WebCore::TypingCommand::updateSelectionIfDifferentFromCurrentSelection): Added.
        (WebCore::TypingCommand::insertTextRunWithoutNewlines): Updates InsertTextCommand's selection as needed.
        * editing/TypingCommand.h:
2010-12-03  Ryosuke Niwa  <rniwa@webkit.org>

        Reviewed by Darin Adler.

        REGRESSION: Crash when deleting text after textarea's value is modified on input event
        https://bugs.webkit.org/show_bug.cgi?id=49962

        Added tests to ensure inserting and deleting a character inside input or textarea
        succeeds even if the value of those elements have been rewritten by its input event handler.

        * editing/input/set-value-on-input-and-delete-expected.txt: Added.
        * editing/input/set-value-on-input-and-delete.html: Added.
        * editing/input/set-value-on-input-and-forward-delete-expected.txt: Added.
        * editing/input/set-value-on-input-and-forward-delete.html: Added.
        * editing/input/set-value-on-input-and-type-input-expected.txt: Added.
        * editing/input/set-value-on-input-and-type-input.html: Added.
        * editing/input/set-value-on-input-and-type-textarea-expected.txt: Added.
        * editing/input/set-value-on-input-and-type-textarea.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@73279 268f45cc-cd09-0410-ab3c-d52691b4dbfc
13 files changed:
LayoutTests/ChangeLog
LayoutTests/editing/input/set-value-on-input-and-delete-expected.txt [new file with mode: 0644]
LayoutTests/editing/input/set-value-on-input-and-delete.html [new file with mode: 0644]
LayoutTests/editing/input/set-value-on-input-and-forward-delete-expected.txt [new file with mode: 0644]
LayoutTests/editing/input/set-value-on-input-and-forward-delete.html [new file with mode: 0644]
LayoutTests/editing/input/set-value-on-input-and-type-input-expected.txt [new file with mode: 0644]
LayoutTests/editing/input/set-value-on-input-and-type-input.html [new file with mode: 0644]
LayoutTests/editing/input/set-value-on-input-and-type-textarea-expected.txt [new file with mode: 0644]
LayoutTests/editing/input/set-value-on-input-and-type-textarea.html [new file with mode: 0644]
WebCore/ChangeLog
WebCore/editing/InsertTextCommand.h
WebCore/editing/TypingCommand.cpp
WebCore/editing/TypingCommand.h