2011-03-30 Levi Weintraub <leviw@chromium.org>
authorleviw@chromium.org <leviw@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 30 Mar 2011 10:46:13 +0000 (10:46 +0000)
committerleviw@chromium.org <leviw@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 30 Mar 2011 10:46:13 +0000 (10:46 +0000)
        Reviewed by Ryosuke Niwa.

        BreakBlockQuoteCommand assumes all li tags have list item renderers
        https://bugs.webkit.org/show_bug.cgi?id=57253

        Checking that the renderers of li nodes are actually RenderListItems
        before treating them as such.

        * editing/execCommand/crash-breaking-blockquote-with-list.html: Added.
        * editing/execCommand/crash-breaking-blockquote-with-list-expected.txt: Added.
2011-03-30  Levi Weintraub  <leviw@chromium.org>

        Reviewed by Ryosuke Niwa.

        BreakBlockQuoteCommand assumes all li tags have list item renderers
        https://bugs.webkit.org/show_bug.cgi?id=57253

        Checking that the renderers of li nodes are actually RenderListItems
        before treating them as such.

        Test: editing/execCommand/crash-breaking-blockquote-with-list.html

        * editing/BreakBlockquoteCommand.cpp:
        (WebCore::BreakBlockQuoteCommand::doApply):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@82421 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/editing/execCommand/crash-breaking-blockquote-with-list-expected.txt [new file with mode: 0644]
LayoutTests/editing/execCommand/crash-breaking-blockquote-with-list.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/editing/BreakBlockquoteCommand.cpp

index d574b29..5ba3408 100644 (file)
@@ -1,3 +1,16 @@
+2011-03-30  Levi Weintraub  <leviw@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        BreakBlockQuoteCommand assumes all li tags have list item renderers
+        https://bugs.webkit.org/show_bug.cgi?id=57253
+
+        Checking that the renderers of li nodes are actually RenderListItems
+        before treating them as such.
+
+        * editing/execCommand/crash-breaking-blockquote-with-list.html: Added.
+        * editing/execCommand/crash-breaking-blockquote-with-list-expected.txt: Added.
+
 2011-03-30  Yael Aharon  <yael.aharon@nokia.com>
 
         Reviewed by Eric Seidel.
diff --git a/LayoutTests/editing/execCommand/crash-breaking-blockquote-with-list-expected.txt b/LayoutTests/editing/execCommand/crash-breaking-blockquote-with-list-expected.txt
new file mode 100644 (file)
index 0000000..5c6c2e4
--- /dev/null
@@ -0,0 +1 @@
+This test assures that inserting a newline in a list nested in a blockquote doesn't crash.
diff --git a/LayoutTests/editing/execCommand/crash-breaking-blockquote-with-list.html b/LayoutTests/editing/execCommand/crash-breaking-blockquote-with-list.html
new file mode 100644 (file)
index 0000000..3f22ead
--- /dev/null
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<body>
+<div id="description">This test assures that inserting a newline in a list nested in a blockquote doesn't crash.</div>
+<div contenteditable="true" id="container">
+<blockquote type="cite">
+    <ol><li style=" -webkit-appearance: relevancy-level-indicator" id="two">TwoTwo</li></ol>
+</blockquote>
+</div>
+<script>
+    li = document.getElementById("two");
+    text = li.firstChild;
+    selection = window.getSelection();
+    selection.setPosition(text, 3);
+    document.execCommand("InsertNewlineInQuotedContent");
+    var div = document.getElementById("container");
+    div.parentNode.removeChild(div);
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+</body>
\ No newline at end of file
index 4bfd981..6d71e04 100644 (file)
@@ -1,3 +1,18 @@
+2011-03-30  Levi Weintraub  <leviw@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        BreakBlockQuoteCommand assumes all li tags have list item renderers
+        https://bugs.webkit.org/show_bug.cgi?id=57253
+
+        Checking that the renderers of li nodes are actually RenderListItems
+        before treating them as such.
+
+        Test: editing/execCommand/crash-breaking-blockquote-with-list.html
+
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockQuoteCommand::doApply):
+
 2011-03-30  Pavel Feldman  <pfeldman@chromium.org>
 
         Not reviewed: fixing typo in the inspector front-end.
index 7070271..91f496c 100644 (file)
@@ -148,7 +148,7 @@ void BreakBlockquoteCommand::doApply()
             // find the first one so that we know where to start numbering.
             while (listChildNode && !listChildNode->hasTagName(liTag))
                 listChildNode = listChildNode->nextSibling();
-            if (listChildNode && listChildNode->renderer())
+            if (listChildNode && listChildNode->renderer() && listChildNode->renderer()->isListItem())
                 setNodeAttribute(static_cast<Element*>(clonedChild.get()), startAttr, String::number(toRenderListItem(listChildNode->renderer())->value()));
         }