LayoutTests:

        Reviewed by Justin.

        Testcase for:
        http://bugzilla.opendarwin.org/show_bug.cgi?id=10579
        AppleStyleCommand::applyBlockStyle crash

        * editing/style/table-selection-expected.checksum: Added.
        * editing/style/table-selection-expected.png: Added.
        * editing/style/table-selection-expected.txt: Added.
        * editing/style/table-selection.html: Added.

WebCore:

        Reviewed by Justin.

        http://bugzilla.opendarwin.org/show_bug.cgi?id=10579
        AppleStyleCommand::applyBlockStyle crash

        * editing/ApplyStyleCommand.cpp:
        (WebCore::ApplyStyleCommand::applyBlockStyle): Prevent a crash by
        making sure that the 'beyondEnd' node is after the start node.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@16194 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 1838159c5372493ac6e8f676a5473ab21c545d9f..639c941c2c5705f1c3a7605069388af09b023ef4 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,16 @@
+2006-09-02  Graham Dennis  <graham.dennis@gmail.com>
+
+        Reviewed by Justin.
+
+        Testcase for:
+        http://bugzilla.opendarwin.org/show_bug.cgi?id=10579
+        AppleStyleCommand::applyBlockStyle crash
+
+        * editing/style/table-selection-expected.checksum: Added.
+        * editing/style/table-selection-expected.png: Added.
+        * editing/style/table-selection-expected.txt: Added.
+        * editing/style/table-selection.html: Added.
+
 2006-09-01  Adele Peterson  <adele@apple.com>
 
         Reviewed by Tim Omernick.

diff --git a/LayoutTests/editing/style/table-selection-expected.checksum b/LayoutTests/editing/style/table-selection-expected.checksum
new file mode 100644 (file)
index 0000000..a573ec8
--- /dev/null
+++ b/LayoutTests/editing/style/table-selection-expected.checksum
@@ -0,0 +1 @@
+149cf71db7fafcb4a948a23d00b3a2ba
\ No newline at end of file

diff --git a/LayoutTests/editing/style/table-selection-expected.png b/LayoutTests/editing/style/table-selection-expected.png
new file mode 100644 (file)
index 0000000..0bc6ce2
Binary files /dev/null and b/LayoutTests/editing/style/table-selection-expected.png differ

diff --git a/LayoutTests/editing/style/table-selection-expected.txt b/LayoutTests/editing/style/table-selection-expected.txt
new file mode 100644 (file)
index 0000000..55c1e1c
--- /dev/null
+++ b/LayoutTests/editing/style/table-selection-expected.txt
@@ -0,0 +1,26 @@
+EDITING DELEGATE: shouldBeginEditingInDOMRange:range from 0 of BODY > HTML > #document to 4 of BODY > HTML > #document
+EDITING DELEGATE: webViewDidBeginEditing:WebViewDidBeginEditingNotification
+EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
+EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
+EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
+EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
+EDITING DELEGATE: shouldChangeSelectedDOMRange:range from 1 of #text > TD > TR > TBODY > TABLE > DIV > BODY > HTML > #document to 2 of TABLE > DIV > BODY > HTML > #document toDOMRange:range from 1 of #text > TD > TR > TBODY > TABLE > DIV > BODY > HTML > #document to 2 of TABLE > DIV > BODY > HTML > #document affinity:NSSelectionAffinityDownstream stillSelecting:FALSE
+EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
+layer at (0,0) size 800x600
+  RenderView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  RenderBlock {HTML} at (0,0) size 800x600
+    RenderBody {BODY} at (8,8) size 784x584
+      RenderBlock {DIV} at (0,0) size 784x74 [border: (2px solid #FF0000)]
+        RenderTable {TABLE} at (14,14) size 27x46
+          RenderTableSection {TBODY} at (0,0) size 27x46
+            RenderTableRow {TR} at (0,2) size 27x20
+              RenderTableCell {TD} at (2,2) size 23x20 [r=0 c=0 rs=1 cs=1]
+                RenderText {#text} at (1,1) size 21x18
+                  text run at (1,1) width 21: "foo"
+            RenderTableRow {TR} at (0,24) size 27x20
+              RenderTableCell {TD} at (2,24) size 23x20 [r=1 c=0 rs=1 cs=1]
+                RenderText {#text} at (1,1) size 20x18
+                  text run at (1,1) width 20: "bar"
+selection start: position 1 of child 0 {#text} of child 0 {TD} of child 0 {TR} of child 1 {TBODY} of child 1 {TABLE} of child 1 {DIV} of child 1 {BODY} of child 0 {HTML} of document
+selection end:   position 2 of child 1 {TABLE} of child 1 {DIV} of child 1 {BODY} of child 0 {HTML} of document

diff --git a/LayoutTests/editing/style/table-selection.html b/LayoutTests/editing/style/table-selection.html
new file mode 100644 (file)
index 0000000..68f4619
--- /dev/null
+++ b/LayoutTests/editing/style/table-selection.html
@@ -0,0 +1,36 @@
+<html> 
+<head>
+
+<style>
+.editing { 
+    border: 2px solid red; 
+    padding: 12px; 
+    font-size: 24px; 
+}
+</style>
+<script src=../editing.js language="JavaScript" type="text/JavaScript" ></script>
+
+<script>
+
+function editingTest() {
+    var selection = window.getSelection();
+    selection.setPosition(document.getElementById("selStart"), 0);
+    extendSelectionForwardByLineCommand();
+    extendSelectionForwardByLineCommand();
+    justifyCenterCommand();
+}
+
+</script>
+
+<title>Editing Test</title> 
+</head> 
+<body id="root" contenteditable>
+<div id="test" class="editing">
+<table> <tr> <td id="selStart"> foo </td> </tr> <tr> <td id="selEnd"> bar </td> </tr> </table>
+</div>
+<script>
+runEditingTest();
+</script>
+
+</body>
+</html>

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 1c30780ac909c61e93bb080f4473c0c952de34e7..b072f060ee6ba37acb7a71e8aeb99875f7f8a539 100644 (file)
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,14 @@
+2006-09-02  Graham Dennis  <graham.dennis@gmail.com>
+
+        Reviewed by Justin.
+        
+        http://bugzilla.opendarwin.org/show_bug.cgi?id=10579
+        AppleStyleCommand::applyBlockStyle crash
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::applyBlockStyle): Prevent a crash by
+        making sure that the 'beyondEnd' node is after the start node.
+
 2006-09-02  Krzysztof Kowalczyk  <kkowalczyk@gmail.com>
 
         Reviewed by Tim H.

diff --git a/WebCore/editing/ApplyStyleCommand.cpp b/WebCore/editing/ApplyStyleCommand.cpp
index 1210463c67ad7cd37db82467d2d29016db6554ad..d650218e96cd5e1e904ca8e36f647afd5004971b 100644 (file)
--- a/WebCore/editing/ApplyStyleCommand.cpp
+++ b/WebCore/editing/ApplyStyleCommand.cpp
@@ -371,7 +371,15 @@ void ApplyStyleCommand::applyBlockStyle(CSSMutableStyleDeclaration *style)
     // Also, gather up all the nodes we want to process in a DeprecatedPtrList before
     // doing anything. This averts any bugs iterating over these nodes
     // once you start removing and applying style.
-    Node *beyondEnd = end.node()->traverseNextNode();
+    
+    // If the end node is before the start node (can only happen if the end node is
+    // an ancestor of the start node), we gather nodes up to the next sibling of the end node
+    Node *beyondEnd;
+    if (start.node()->isAncestor(end.node()))
+        beyondEnd = end.node()->traverseNextSibling();
+    else
+        beyondEnd = end.node()->traverseNextNode();
+
     DeprecatedPtrList<Node> nodes;
     for (Node *node = start.node(); node != beyondEnd; node = node->traverseNextNode())
         nodes.append(node);