LayoutTests:

        Reviewed by adele

        <rdar://problem/5078739>
        Crash in in ReplaceSelectionCommand if the fragment contains only a style span

        * editing/pasteboard/5078739-expected.txt: Added.
        * editing/pasteboard/5078739.html: Added.

WebCore:

        Reviewed by adele

        <rdar://problem/5078739>
        Crash in in ReplaceSelectionCommand if the fragment contains only a style span

        * editing/ReplaceSelectionCommand.cpp:
        (WebCore::ReplaceSelectionCommand::doApply): Check
        for an empty fragment after removing a redundant
        style span instead of before.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@20456 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 49370014c21925e01e53cd31f10c0310320381e3..f03f18cb2136b1f5f638aa5d7d241fdb2ad30257 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2007-03-23  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by adele
+
+        <rdar://problem/5078739> 
+        Crash in in ReplaceSelectionCommand if the fragment contains only a style span
+
+        * editing/pasteboard/5078739-expected.txt: Added.
+        * editing/pasteboard/5078739.html: Added.
+
 2007-03-23  Justin Garcia  <justin.garcia@apple.com>
 
         Reviewed by darin

diff --git a/LayoutTests/editing/pasteboard/5078739-expected.txt b/LayoutTests/editing/pasteboard/5078739-expected.txt
new file mode 100644 (file)
index 0000000..6edeb13
--- /dev/null
+++ b/LayoutTests/editing/pasteboard/5078739-expected.txt
@@ -0,0 +1,4 @@
+This tests for a crash when the fragment contains only an interchange newline.
+
+
+

diff --git a/LayoutTests/editing/pasteboard/5078739.html b/LayoutTests/editing/pasteboard/5078739.html
new file mode 100644 (file)
index 0000000..5a6e288
--- /dev/null
+++ b/LayoutTests/editing/pasteboard/5078739.html
@@ -0,0 +1,11 @@
+<p>This tests for a crash when the fragment contains only an interchange newline.</p>
+<div id="div" contenteditable="true"><br></div>
+
+<script>
+if (window.layoutTestController)
+    window.layoutTestController.dumpAsText();
+    
+var div = document.getElementById("div");
+div.focus();
+document.execCommand("InsertHTML", false, "<span class='Apple-style-span' style='border-collapse: separate; color: rgb(0, 0, 0); font-family: Times; font-size: 16px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-fill-color: rgb(0, 0, 0); -webkit-text-size-adjust: auto; -webkit-text-stroke-color: rgb(0, 0, 0); -webkit-text-stroke-width: 0; '></span>");
+</script>

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index fe88cd129c0222bb383fc606f1539691db758055..cbf22c6999f48546765d32042fc908681a46f591 100644 (file)
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,15 @@
+2007-03-23  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by adele
+
+        <rdar://problem/5078739> 
+        Crash in in ReplaceSelectionCommand if the fragment contains only a style span
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::doApply): Check 
+        for an empty fragment after removing a redundant
+        style span instead of before.
+
 2007-03-23  David Hyatt  <hyatt@apple.com>
 
         <rdar://problem/5085063>

diff --git a/WebCore/editing/ReplaceSelectionCommand.cpp b/WebCore/editing/ReplaceSelectionCommand.cpp
index 6c54431622ff4e5c39669c122b81ad478635b120..346460ccc43c254e940cf86d3f34fcfa84b18a9d 100644 (file)
--- a/WebCore/editing/ReplaceSelectionCommand.cpp
+++ b/WebCore/editing/ReplaceSelectionCommand.cpp
@@ -544,10 +544,6 @@ void ReplaceSelectionCommand::doApply()
     frame->clearTypingStyle();
     setTypingStyle(0);    
     
-    // We're finished if there is nothing to add.
-    if (fragment.isEmpty() || !fragment.firstChild())
-        return;
-        
     // Remove the top level style span if its unnecessary before inserting it into the document, its faster.
     RefPtr<CSSMutableStyleDeclaration> styleAtInsertionPos = insertionPos.computedStyle()->copyInheritableProperties();
     if (isStyleSpan(fragment.firstChild())) {
@@ -557,6 +553,10 @@ void ReplaceSelectionCommand::doApply()
             fragment.removeNodePreservingChildren(styleSpan);
     }
     
+    // We're finished if there is nothing to add.
+    if (fragment.isEmpty() || !fragment.firstChild())
+        return;
+    
     // 1) Insert the content.
     // 2) Remove redundant styles and style tags, this inner <b> for example: <b>foo <b>bar</b> baz</b>.
     // 3) Merge the start of the added content with the content before the position being pasted into.