2011-06-30 Abhishek Arya <inferno@chromium.org>
authorinferno@chromium.org <inferno@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 30 Jun 2011 17:00:48 +0000 (17:00 +0000)
committerinferno@chromium.org <inferno@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 30 Jun 2011 17:00:48 +0000 (17:00 +0000)
commitb3b050982f8ac1fc885531af48fdad724c89d5dc
tree29c28c36751971622b81ffa5787cc65ea4dafbf0
parent709ab208e0e9b3c5e21ad85fe2c10d59e0e49c2e
2011-06-30  Abhishek Arya  <inferno@chromium.org>

        Reviewed by Ryosuke Niwa.

        Crash when calling DOMSubtreeModified event when extracting range
        contents.
        https://bugs.webkit.org/show_bug.cgi?id=63650

        Convert a few nodes to RefPtrs and add commonRoot verification checks
        for Range::processContents.

        Tests: fast/dom/Range/range-extract-contents-event-fire-crash.html
               fast/dom/Range/range-extract-contents-event-fire-crash2.html

        * dom/Range.cpp:
        (WebCore::childOfCommonRootBeforeOffset):
        (WebCore::Range::processContents):
        (WebCore::Range::processContentsBetweenOffsets):
        (WebCore::Range::processAncestorsAndTheirSiblings):
2011-06-29  Abhishek Arya  <inferno@chromium.org>

        Reviewed by Ryosuke Niwa.

        Crash when calling DOMSubtreeModified event when extracting range
        contents.
        https://bugs.webkit.org/show_bug.cgi?id=63650

        * fast/dom/Range/range-extract-contents-event-fire-crash-expected.txt: Added.
        * fast/dom/Range/range-extract-contents-event-fire-crash.html: Added.
        * fast/dom/Range/range-extract-contents-event-fire-crash2-expected.txt: Added.
        * fast/dom/Range/range-extract-contents-event-fire-crash2.html: Added.
        * fast/dom/Range/range-extractContents.html: remove the appending of fragment
        in this crasher test since we now refptr the nodes and leftContents will be visible.
        This crasher test does not need to show the extractContents fragment.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@90130 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/dom/Range/range-extract-contents-event-fire-crash-expected.txt [new file with mode: 0644]
LayoutTests/fast/dom/Range/range-extract-contents-event-fire-crash.html [new file with mode: 0644]
LayoutTests/fast/dom/Range/range-extract-contents-event-fire-crash2-expected.txt [new file with mode: 0644]
LayoutTests/fast/dom/Range/range-extract-contents-event-fire-crash2.html [new file with mode: 0644]
LayoutTests/fast/dom/Range/range-extractContents.html
Source/WebCore/ChangeLog
Source/WebCore/dom/Range.cpp