LayoutTests:
authorantti <antti@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sun, 25 Mar 2007 22:42:31 +0000 (22:42 +0000)
committerantti <antti@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sun, 25 Mar 2007 22:42:31 +0000 (22:42 +0000)
        Reviewed by Adam.

        Test for <rdar://problem/5049842>
        Gmail Editor: Dragging message text in the message body results in a crash at WebCore::Frame::eventHandler()

        * editing/pasteboard/drag-drop-dead-frame-expected.checksum: Added.
        * editing/pasteboard/drag-drop-dead-frame-expected.png: Added.
        * editing/pasteboard/drag-drop-dead-frame-expected.txt: Added.
        * editing/pasteboard/drag-drop-dead-frame.html: Added.

WebCore:

        Reviewed by Adam.

        Fix <rdar://problem/5049842>
        Gmail Editor: Dragging message text in the message body results in a crash at WebCore::Frame::eventHandler()

        Null check frame in m_dragTarget, it might be gone already.

        * page/EventHandler.cpp:
        (WebCore::EventHandler::updateDragAndDrop):
        (WebCore::EventHandler::cancelDragAndDrop):
        (WebCore::EventHandler::performDragAndDrop):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@20490 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/editing/pasteboard/drag-drop-dead-frame-expected.checksum [new file with mode: 0644]
LayoutTests/editing/pasteboard/drag-drop-dead-frame-expected.png [new file with mode: 0644]
LayoutTests/editing/pasteboard/drag-drop-dead-frame-expected.txt [new file with mode: 0644]
LayoutTests/editing/pasteboard/drag-drop-dead-frame.html [new file with mode: 0644]
WebCore/ChangeLog
WebCore/page/EventHandler.cpp

index 5d0cc884ad703a0e69c18e4a8ef2b8bd8f94b260..221f770bf1831182c881a863d0437d861cdee9c5 100644 (file)
@@ -1,3 +1,15 @@
+2007-03-26  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Adam.
+        
+        Test for <rdar://problem/5049842>
+        Gmail Editor: Dragging message text in the message body results in a crash at WebCore::Frame::eventHandler()
+
+        * editing/pasteboard/drag-drop-dead-frame-expected.checksum: Added.
+        * editing/pasteboard/drag-drop-dead-frame-expected.png: Added.
+        * editing/pasteboard/drag-drop-dead-frame-expected.txt: Added.
+        * editing/pasteboard/drag-drop-dead-frame.html: Added.
+
 2007-03-24  Mitz Pettel  <mitz@webkit.org>
 
         Reviewed by Darin.
diff --git a/LayoutTests/editing/pasteboard/drag-drop-dead-frame-expected.checksum b/LayoutTests/editing/pasteboard/drag-drop-dead-frame-expected.checksum
new file mode 100644 (file)
index 0000000..6b6cfc0
--- /dev/null
@@ -0,0 +1 @@
+0958264e5dc2e3ce61fe5a865c3d3426
\ No newline at end of file
diff --git a/LayoutTests/editing/pasteboard/drag-drop-dead-frame-expected.png b/LayoutTests/editing/pasteboard/drag-drop-dead-frame-expected.png
new file mode 100644 (file)
index 0000000..4690843
Binary files /dev/null and b/LayoutTests/editing/pasteboard/drag-drop-dead-frame-expected.png differ
diff --git a/LayoutTests/editing/pasteboard/drag-drop-dead-frame-expected.txt b/LayoutTests/editing/pasteboard/drag-drop-dead-frame-expected.txt
new file mode 100644 (file)
index 0000000..f0082bd
--- /dev/null
@@ -0,0 +1,25 @@
+EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
+EDITING DELEGATE: shouldInsertNode:#document-fragment replacingDOMRange:range from 0 of BODY > HTML > #document to 0 of BODY > HTML > #document givenAction:WebViewInsertActionDropped
+EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
+EDITING DELEGATE: shouldChangeSelectedDOMRange:range from 0 of BODY > HTML > #document to 0 of BODY > HTML > #document toDOMRange:range from 0 of #text > BODY > HTML > #document to 5 of #text > BODY > HTML > #document affinity:NSSelectionAffinityDownstream stillSelecting:FALSE
+EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
+EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
+layer at (0,0) size 800x600
+  RenderView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  RenderBlock {HTML} at (0,0) size 800x600
+    RenderBody {BODY} at (8,8) size 784x584
+      RenderBlock {P} at (0,0) size 784x18
+        RenderText {#text} at (0,0) size 616x18
+          text run at (0,0) width 616: "Check you don't crash when your previous drag target frame is deleted <rdar://problem/5049842>"
+      RenderBlock {DIV} at (0,34) size 784x18
+        RenderInline {SPAN} at (0,0) size 31x18
+          RenderText {#text} at (0,0) size 31x18
+            text run at (0,0) width 31: "hello"
+      RenderBlock (anonymous) at (0,52) size 784x0
+        RenderText {#text} at (0,0) size 0x0
+        RenderText {#text} at (0,0) size 0x0
+        RenderText {#text} at (0,0) size 0x0
+        RenderText {#text} at (0,0) size 0x0
+selection start: position 0 of child 0 {#text} of child 0 {SPAN} of child 3 {DIV} of child 1 {BODY} of child 0 {HTML} of document
+selection end:   position 5 of child 0 {#text} of child 0 {SPAN} of child 3 {DIV} of child 1 {BODY} of child 0 {HTML} of document
diff --git a/LayoutTests/editing/pasteboard/drag-drop-dead-frame.html b/LayoutTests/editing/pasteboard/drag-drop-dead-frame.html
new file mode 100644 (file)
index 0000000..58a3e13
--- /dev/null
@@ -0,0 +1,80 @@
+<html> 
+<head>
+<script src=../editing.js type="text/javascript"></script>
+<script>
+
+var framex;
+var framey;
+
+function editingTest() {
+  
+    if (!window.layoutTestController)
+        return;
+
+    window.layoutTestController.waitUntilDone();
+    
+    var t = document.getElementById("targetframe");
+    framex = t.offsetLeft + 10;
+    framey = t.offsetTop + t.offsetHeight / 2;
+    
+    // Drag 'hello'
+    dragDropIt1();
+}
+
+
+function dragDropIt1() {
+    var e = document.getElementById("dragme");
+    window.getSelection().setBaseAndExtent(e, 0, e, 4); 
+    x = e.offsetLeft + 10;
+    y = e.offsetTop + e.offsetHeight / 2;
+    eventSender.mouseMoveTo(x, y);
+    eventSender.mouseDown();
+    
+    eventSender.leapForward(500);
+    eventSender.mouseMoveTo(framex, framey);
+    setTimeout(dropIt1, 100);
+}
+
+function dropIt1() {
+
+    // Drop it off to the frame
+    eventSender.mouseUp();
+    setTimeout(deleteFrameAndDrop, 1000);
+}
+
+function deleteFrameAndDrop() {
+
+    // Delete the frame where we just dragged somet stuff
+    var f = document.getElementById("targetframe");
+    f.parentNode.removeChild(f);
+    
+    // Do drag drop again
+    var e = document.getElementById("dragme");
+    x = e.offsetLeft + 10;
+    y = e.offsetTop + e.offsetHeight / 2;
+    eventSender.mouseMoveTo(x, y);
+    eventSender.mouseDown();
+    eventSender.leapForward(500);
+    eventSender.mouseMoveTo(framex, framey);
+    setTimeout(dropIt2, 100);
+}
+
+function dropIt2() {
+    // Drop it off to somewhere
+    eventSender.mouseUp();
+    window.layoutTestController.notifyDone();
+}
+
+
+
+</script>
+<title>Check you don't crash when your previous drag target frame is deleted</title> 
+</head> 
+<body>
+
+<p>Check you don't crash when your previous drag target frame is deleted &lt;rdar://problem/5049842&gt;</p>
+<div><span id="dragme">hello</span></div>
+<iframe id=targetframe src="data:text/html;charset=utf-8,%3Cbody%20contentEditable%3Dtrue%3E%0D%0A"></iframe>
+<script>runEditingTest();</script>
+</body>
+</html>
index 612a6bf3ee6815c6f984ca981f9054b0c76bf7bd..67aaf0fa3fc2d31b07f51b75c567c3cc24ea2794 100644 (file)
@@ -1,3 +1,17 @@
+2007-03-25  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Adam.
+
+        Fix <rdar://problem/5049842>
+        Gmail Editor: Dragging message text in the message body results in a crash at WebCore::Frame::eventHandler()
+
+        Null check frame in m_dragTarget, it might be gone already.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::updateDragAndDrop):
+        (WebCore::EventHandler::cancelDragAndDrop):
+        (WebCore::EventHandler::performDragAndDrop):
+
 2007-03-25  Alexey Proskuryakov  <ap@webkit.org>
 
         Reviewed by Darin.
         (WebCore::overrideLayoutOperation):
         (WebCore::ATSULayoutParameters::initialize):
 
->>>>>>> .r20473
 2007-03-24  David Hyatt  <hyatt@apple.com>
 
         Fix for <rdar://problem/5086400>, images scrolled offscreen continue to animate.  Safari 2 would
index 6782173be3e41f10c8846e6bb569b83a60033700..8f275b28881501ecbb5dd74644a2939e9a4e5528 100644 (file)
@@ -1010,11 +1010,14 @@ bool EventHandler::updateDragAndDrop(const PlatformMouseEvent& event, Clipboard*
             else
                 accept = dispatchDragEvent(dragenterEvent, newTarget, event, clipboard);
         
-        if (m_dragTarget)
-            if (m_dragTarget->hasTagName(frameTag) || m_dragTarget->hasTagName(iframeTag))
-                accept = static_cast<HTMLFrameElementBase*>(m_dragTarget.get())->contentFrame()->eventHandler()->updateDragAndDrop(event, clipboard);
+        if (m_dragTarget) {
+            Frame* frame = (m_dragTarget->hasTagName(frameTag) || m_dragTarget->hasTagName(iframeTag)) 
+                            ? static_cast<HTMLFrameElementBase*>(m_dragTarget.get())->contentFrame() : 0;
+            if (frame)
+                accept = frame->eventHandler()->updateDragAndDrop(event, clipboard);
             else
                 dispatchDragEvent(dragleaveEvent, m_dragTarget.get(), event, clipboard);
+        }
     } else {
         if (newTarget)
             if (newTarget->hasTagName(frameTag) || newTarget->hasTagName(iframeTag))
@@ -1029,22 +1032,28 @@ bool EventHandler::updateDragAndDrop(const PlatformMouseEvent& event, Clipboard*
 
 void EventHandler::cancelDragAndDrop(const PlatformMouseEvent& event, Clipboard* clipboard)
 {
-    if (m_dragTarget)
-        if (m_dragTarget->hasTagName(frameTag) || m_dragTarget->hasTagName(iframeTag))
-            static_cast<HTMLFrameElementBase*>(m_dragTarget.get())->contentFrame()->eventHandler()->cancelDragAndDrop(event, clipboard);
+    if (m_dragTarget) {
+        Frame* frame = (m_dragTarget->hasTagName(frameTag) || m_dragTarget->hasTagName(iframeTag)) 
+                        ? static_cast<HTMLFrameElementBase*>(m_dragTarget.get())->contentFrame() : 0;
+        if (frame)
+            frame->eventHandler()->cancelDragAndDrop(event, clipboard);
         else
             dispatchDragEvent(dragleaveEvent, m_dragTarget.get(), event, clipboard);
+    }
     m_dragTarget = 0;
 }
 
 bool EventHandler::performDragAndDrop(const PlatformMouseEvent& event, Clipboard* clipboard)
 {
     bool accept = false;
-    if (m_dragTarget)
-        if (m_dragTarget->hasTagName(frameTag) || m_dragTarget->hasTagName(iframeTag))
-            accept = static_cast<HTMLFrameElementBase*>(m_dragTarget.get())->contentFrame()->eventHandler()->performDragAndDrop(event, clipboard);
+    if (m_dragTarget) {
+        Frame* frame = (m_dragTarget->hasTagName(frameTag) || m_dragTarget->hasTagName(iframeTag)) 
+                        ? static_cast<HTMLFrameElementBase*>(m_dragTarget.get())->contentFrame() : 0;
+        if (frame)
+            accept = frame->eventHandler()->performDragAndDrop(event, clipboard);
         else
             accept = dispatchDragEvent(dropEvent, m_dragTarget.get(), event, clipboard);
+    }
     m_dragTarget = 0;
     return accept;
 }