LayoutTests:

        Reviewed by Oliver.

        * editing/pasteboard/5245519-expected.checksum: Added.
        * editing/pasteboard/5245519-expected.png: Added.
        * editing/pasteboard/5245519-expected.txt: Added.
        * editing/pasteboard/5245519.html: Added.

WebCore:

        Reviewed by Oliver.

        <rdar://problem/5245519> CrashTracer: [USER] 457 crashes in Mail at WebCore::CSSComputedStyleDeclaration::copyInheritableProperties()

        If the user pastes something into a region that ends up being
        invisible, or if the pasted content contains style spans
        that are render-less, we'll crash when we try to remove
        redundant styles from style spans.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::CSSComputedStyleDeclaration::copyInheritableProperties):
        Add null checks.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@22038 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index dc58e445d3954b0ceeab211b928c6c3ac08b31a1..e8261886f707d9495eacf36300361d19e8408fff 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,12 @@
+2007-06-06  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Oliver.
+
+        * editing/pasteboard/5245519-expected.checksum: Added.
+        * editing/pasteboard/5245519-expected.png: Added.
+        * editing/pasteboard/5245519-expected.txt: Added.
+        * editing/pasteboard/5245519.html: Added.
+
 2007-06-06  Justin Garcia  <justin.garcia@apple.com>
 
         Reviewed by Harrison.

diff --git a/LayoutTests/editing/pasteboard/5245519-expected.checksum b/LayoutTests/editing/pasteboard/5245519-expected.checksum
new file mode 100644 (file)
index 0000000..b9c07d8
--- /dev/null
+++ b/LayoutTests/editing/pasteboard/5245519-expected.checksum
@@ -0,0 +1 @@
+37cc348638ebafbdca4889bdfb9746e4
\ No newline at end of file

diff --git a/LayoutTests/editing/pasteboard/5245519-expected.png b/LayoutTests/editing/pasteboard/5245519-expected.png
new file mode 100644 (file)
index 0000000..bb591b0
Binary files /dev/null and b/LayoutTests/editing/pasteboard/5245519-expected.png differ

diff --git a/LayoutTests/editing/pasteboard/5245519-expected.txt b/LayoutTests/editing/pasteboard/5245519-expected.txt
new file mode 100644 (file)
index 0000000..032a37c
--- /dev/null
+++ b/LayoutTests/editing/pasteboard/5245519-expected.txt
@@ -0,0 +1,15 @@
+layer at (0,0) size 800x600
+  RenderView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  RenderBlock {HTML} at (0,0) size 800x600
+    RenderBody {BODY} at (8,8) size 784x584
+      RenderBlock {P} at (0,0) size 784x36
+        RenderText {#text} at (0,0) size 776x36
+          text run at (0,0) width 776: "This tests for a crash when pasting content that contains Apple-style-spans that don't have renderers.' You should see 'Hello"
+          text run at (0,18) width 48: "World!'"
+      RenderBlock {DIV} at (0,52) size 784x18
+        RenderText {#text} at (0,0) size 39x18
+          text run at (0,0) width 39: "Hello "
+        RenderText {#text} at (39,0) size 45x18
+          text run at (39,0) width 45: "World!"
+caret: position 6 of child 1 {#text} of child 2 {DIV} of child 0 {BODY} of child 0 {HTML} of document

diff --git a/LayoutTests/editing/pasteboard/5245519.html b/LayoutTests/editing/pasteboard/5245519.html
new file mode 100644 (file)
index 0000000..b576743
--- /dev/null
+++ b/LayoutTests/editing/pasteboard/5245519.html
@@ -0,0 +1,8 @@
+<p>This tests for a crash when pasting content that contains Apple-style-spans that don't have renderers.' You should see 'Hello World!'</p>
+<div id="div" contenteditable="true"><br></div>
+
+<script>
+var div = document.getElementById("div");
+div.focus();
+document.execCommand("InsertHTML", false, "Hello <span style='display:none;' class='Apple-style-span'></span>World!")
+</script>

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 2d4afa7bd7db614ea1145f6d14b1160bc24cb181..58ffe9d3a7ab92ef31d096fc1d7500354cd9a38e 100644 (file)
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,18 @@
+2007-06-06  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Oliver.
+        
+        <rdar://problem/5245519> CrashTracer: [USER] 457 crashes in Mail at WebCore::CSSComputedStyleDeclaration::copyInheritableProperties()
+        
+        If the user pastes something into a region that ends up being
+        invisible, or if the pasted content contains style spans 
+        that are render-less, we'll crash when we try to remove
+        redundant styles from style spans.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::copyInheritableProperties):
+        Add null checks.
+
 2007-06-06  Justin Garcia  <justin.garcia@apple.com>
 
         Reviewed by Harrison.

diff --git a/WebCore/css/CSSComputedStyleDeclaration.cpp b/WebCore/css/CSSComputedStyleDeclaration.cpp
index 4a80191d337f0c3059c439b211b13856f5ee21e0..220880e1950f4b5a40a2a43dd00676c2c6ca6335 100644 (file)
--- a/WebCore/css/CSSComputedStyleDeclaration.cpp
+++ b/WebCore/css/CSSComputedStyleDeclaration.cpp
@@ -1702,7 +1702,7 @@ void CSSComputedStyleDeclaration::removeComputedInheritablePropertiesFrom(CSSMut
 PassRefPtr<CSSMutableStyleDeclaration> CSSComputedStyleDeclaration::copyInheritableProperties() const
 {
     RefPtr<CSSMutableStyleDeclaration> style = copyPropertiesInSet(inheritableProperties, numInheritableProperties);
-    if (style) {
+    if (style && m_node && m_node->renderer()) {
         // If a node's text fill color is invalid, then its children use 
         // their font-color as their text fill color (they don't
         // inherit it).  Likewise for stroke color.