Crash in ReplaceSelectionCommand::removeRedundantStylesAndKeepStyleSpanInline
authorrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 14 May 2015 21:39:50 +0000 (21:39 +0000)
committerrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 14 May 2015 21:39:50 +0000 (21:39 +0000)
commite8451843bc5d43b71afd2664efd7a1809f828642
treed9e1fc84da0528ebd49ff83ae75a04a45ff01d4e
parent969955d5f8013d1f19aa8a73e3ed7b2dd7e6ae8d
Crash in ReplaceSelectionCommand::removeRedundantStylesAndKeepStyleSpanInline
https://bugs.webkit.org/show_bug.cgi?id=119068

Reviewed by Enrica Casucci.

Source/WebCore:

The bug was caused by makeInsertedContentRoundTrippableWithHTMLTreeBuilder not updating
nodes kept tracked by insertedNodes and moveNodeOutOfAncestor stumbling upon it.

Fixed the bug by updating insertedNodes in makeInsertedContentRoundTrippableWithHTMLTreeBuilder.

Test: editing/inserting/insert-table-in-paragraph-crash.html

* editing/ReplaceSelectionCommand.cpp:
(WebCore::ReplaceSelectionCommand::makeInsertedContentRoundTrippableWithHTMLTreeBuilder):
(WebCore::ReplaceSelectionCommand::moveNodeOutOfAncestor):
* editing/ReplaceSelectionCommand.h:

LayoutTests:

Added a test based on https://chromium.googlesource.com/chromium/blink/+/3500267482e60550ce84fadd6c0db883937ce744

* editing/inserting/insert-table-in-paragraph-crash-expected.txt: Added.
* editing/inserting/insert-table-in-paragraph-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184355 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/editing/inserting/insert-table-in-paragraph-crash-expected.txt [new file with mode: 0644]
LayoutTests/editing/inserting/insert-table-in-paragraph-crash.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/editing/ReplaceSelectionCommand.cpp
Source/WebCore/editing/ReplaceSelectionCommand.h