Reviewed by Harrison

        Fix for this bug:

        <rdar://problem/3910425> REGRESSION (Mail): Crash in ReplaceSelectionCommand; selection is empty, leading to null deref

        * khtml/editing/htmlediting.cpp:
        (khtml::MoveSelectionCommand::doApply): The node representing the destination for the move may have
        been deleted. If this is the case, set the destination to the node the delete command provides in
        its ending selection.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@8171 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/WebCore/ChangeLog-2005-08-23 b/WebCore/ChangeLog-2005-08-23
index b8f7d1dfce63d1dcc6924b37fdfa2592a821e054..e7cf5fdaf08724a03b99420cc935f8afed9194a3 100644 (file)
--- a/WebCore/ChangeLog-2005-08-23
+++ b/WebCore/ChangeLog-2005-08-23
@@ -1,3 +1,16 @@
+2004-12-09  Ken Kocienda  <kocienda@apple.com>
+
+        Reviewed by Harrison
+
+        Fix for this bug:
+        
+        <rdar://problem/3910425> REGRESSION (Mail): Crash in ReplaceSelectionCommand; selection is empty, leading to null deref
+
+        * khtml/editing/htmlediting.cpp:
+        (khtml::MoveSelectionCommand::doApply): The node representing the destination for the move may have
+        been deleted. If this is the case, set the destination to the node the delete command provides in
+        its ending selection.
+
 === Safari-175 ===
 
 2004-12-09  Ken Kocienda  <kocienda@apple.com>

diff --git a/WebCore/khtml/editing/htmlediting.cpp b/WebCore/khtml/editing/htmlediting.cpp
index 596ea0108bdd48941d350a2b48f20d45bd74e258..6d1c36191742671d24833655b5df1f08c9af0cb5 100644 (file)
--- a/WebCore/khtml/editing/htmlediting.cpp
+++ b/WebCore/khtml/editing/htmlediting.cpp
@@ -2715,6 +2715,8 @@ void MoveSelectionCommand::doApply()
     Selection selection = endingSelection();
     ASSERT(selection.isRange());
 
+    Position pos = m_position;
+
     // Update the position otherwise it may become invalid after the selection is deleted.
     NodeImpl *positionNode = m_position.node();
     long positionOffset = m_position.offset();
@@ -2726,11 +2728,19 @@ void MoveSelectionCommand::doApply()
         if (selectionStart.node() == positionNode) {
             positionOffset += selectionStart.offset();
         }
+        pos = Position(positionNode, positionOffset);
     }
-    
+
     deleteSelection(m_smartMove);
 
-    setEndingSelection(Position(positionNode, positionOffset));
+    // If the node for the destination has been removed as a result of the deletion,
+    // set the destination to the ending point after the deletion.
+    // Fixes: <rdar://problem/3910425> REGRESSION (Mail): Crash in ReplaceSelectionCommand; 
+    //        selection is empty, leading to null deref
+    if (!pos.node()->inDocument())
+        pos = endingSelection().start();
+
+    setEndingSelection(pos);
     EditCommandPtr cmd(new ReplaceSelectionCommand(document(), m_fragment, true, m_smartMove));
     applyCommandToComposite(cmd);
 }