Crash with ranges across a detached, reparented node tree
authorcevans@google.com <cevans@google.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sat, 19 Nov 2011 00:43:23 +0000 (00:43 +0000)
committercevans@google.com <cevans@google.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sat, 19 Nov 2011 00:43:23 +0000 (00:43 +0000)
commitfcf62eb73cd42ef68a76e045ad0b3d899e38cac3
tree9231d39bff20a71b3d372656224a4a7c7c5f7b65
parent7cf8340359a3b7ceb0106745f62daaef08a034a5
Crash with ranges across a detached, reparented node tree
https://bugs.webkit.org/show_bug.cgi?id=72757

Reviewed by Adam Barth.

Source/WebCore:

Test: fast/dom/move-detached-child-in-range.html

* dom/RangeBoundaryPoint.h:
(WebCore::RangeBoundaryPoint::childBefore): protect the raw child node from getting pulled from under us.

LayoutTests:

* fast/dom/move-detached-child-in-range-expected.txt: Added.
* fast/dom/move-detached-child-in-range.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@100827 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/dom/move-detached-child-in-range-expected.txt [new file with mode: 0644]
LayoutTests/fast/dom/move-detached-child-in-range.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/dom/RangeBoundaryPoint.h