Source/WebCore:
authorenrica@apple.com <enrica@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 20 Mar 2015 00:47:32 +0000 (00:47 +0000)
committerenrica@apple.com <enrica@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 20 Mar 2015 00:47:32 +0000 (00:47 +0000)
REGRESSION (r109593): Clicking after last inline element could cause a crash.
https://bugs.webkit.org/show_bug.cgi?id=142880
rdar://problem/17222294

Reviewed by Ryosuke Niwa.

Test: editing/selection/click-after-last-inline-crash.html

* rendering/RootInlineBox.cpp:
(WebCore::RootInlineBox::closestLeafChildForLogicalLeftPosition):

LayoutTests:
Web Inspector: Adopt ES6 Class Syntax for all Model Objects
https://bugs.webkit.org/show_bug.cgi?id=142858

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2015-03-19
Reviewed by Timothy Hatcher.

* inspector/model/parse-script-syntax-tree.html:
This test was calling a constructor without "new". Class
syntax enforces "new" and threw an exception.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@181773 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/editing/selection/click-after-last-inline-crash-expected.txt [new file with mode: 0644]
LayoutTests/editing/selection/click-after-last-inline-crash.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/rendering/RootInlineBox.cpp

index 553d0f4..857bd91 100644 (file)
 
 2015-03-19  Enrica Casucci  <enrica@apple.com>
 
+        REGRESSION (r109593): Clicking after last inline element could cause a crash.
+        https://bugs.webkit.org/show_bug.cgi?id=142880
+        rdar://problem/17222294
+
+        Reviewed by Ryosuke Niwa.
+
+        * editing/selection/click-after-last-inline-crash-expected.txt: Added.
+        * editing/selection/click-after-last-inline-crash.html: Added.
+
+2015-03-19  Enrica Casucci  <enrica@apple.com>
+
         <attachment> should put URLs on the pasteboard so that Finder can accept drops.
         https://bugs.webkit.org/show_bug.cgi?id=142801
         rdar://problem/19982527
diff --git a/LayoutTests/editing/selection/click-after-last-inline-crash-expected.txt b/LayoutTests/editing/selection/click-after-last-inline-crash-expected.txt
new file mode 100644 (file)
index 0000000..df98c17
--- /dev/null
@@ -0,0 +1,7 @@
+Click after the end of the line with link.
+
+This is a link
+
+It should NOT crash!
+
+PASS
diff --git a/LayoutTests/editing/selection/click-after-last-inline-crash.html b/LayoutTests/editing/selection/click-after-last-inline-crash.html
new file mode 100644 (file)
index 0000000..9cef77e
--- /dev/null
@@ -0,0 +1,23 @@
+<html>
+<body>
+<div style="border: solid red 2px;">
+Click after the end of the line with link.<br><br><a id='test' href="http://aftershock.su/?q=node/259078">This is a link</a><wbr><br><br>It should NOT crash!<br><br>
+</div>
+</body>
+<script>
+if (window.testRunner) {
+    testRunner.dumpAsText();
+    
+    if (!window.eventSender)
+        document.writeln('This test requires eventSender');
+    else {
+        var testElement = document.getElementById('test');
+        eventSender.mouseMoveTo(testElement.offsetLeft + testElement.offsetWidth + 50, testElement.offsetTop + 5);
+        eventSender.mouseDown();
+        eventSender.mouseUp();
+        document.writeln('PASS');
+    }
+}
+
+</script>
+</html>
index 6937ac5..39ce783 100644 (file)
@@ -1,5 +1,18 @@
 2015-03-19  Enrica Casucci  <enrica@apple.com>
 
+        REGRESSION (r109593): Clicking after last inline element could cause a crash.
+        https://bugs.webkit.org/show_bug.cgi?id=142880
+        rdar://problem/17222294
+
+        Reviewed by Ryosuke Niwa.
+
+        Test: editing/selection/click-after-last-inline-crash.html
+
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::closestLeafChildForLogicalLeftPosition):
+
+2015-03-19  Enrica Casucci  <enrica@apple.com>
+
         One more build fix after r181760.
 
         * page/EventHandler.cpp:
index 4244cce..4c479dc 100644 (file)
@@ -763,12 +763,12 @@ InlineBox* RootInlineBox::closestLeafChildForLogicalLeftPosition(int leftPositio
         return firstLeaf;
 
     // Avoid returning a list marker when possible.
-    if (leftPosition <= firstLeaf->logicalLeft() && !firstLeaf->renderer().isListMarker() && (!onlyEditableLeaves || isEditableLeaf(firstLeaf)))
+    if (firstLeaf && leftPosition <= firstLeaf->logicalLeft() && !firstLeaf->renderer().isListMarker() && (!onlyEditableLeaves || isEditableLeaf(firstLeaf)))
         // The leftPosition coordinate is less or equal to left edge of the firstLeaf.
         // Return it.
         return firstLeaf;
 
-    if (leftPosition >= lastLeaf->logicalRight() && !lastLeaf->renderer().isListMarker() && (!onlyEditableLeaves || isEditableLeaf(lastLeaf)))
+    if (lastLeaf && leftPosition >= lastLeaf->logicalRight() && !lastLeaf->renderer().isListMarker() && (!onlyEditableLeaves || isEditableLeaf(lastLeaf)))
         // The leftPosition coordinate is greater or equal to right edge of the lastLeaf.
         // Return it.
         return lastLeaf;