WebCore:

        Reviewed by Adam.

        <rdar://problem/5418891> CrashTracer: [USER] 1 crash in Mail at -[WebViewEditor webView:shouldInsertText:replacingDOMRange:givenAction:]

        * editing/BreakBlockquoteCommand.cpp:
        (WebCore::BreakBlockquoteCommand::doApply): We're reusing the topBlockquote
        variable.  Null it out first.  If there is no new topBlockquote and we don't null
        it out first, we'll assume that there was a new one and crash.

LayoutTests:

        Reviewed by Adam.

        <rdar://problem/5418891> CrashTracer: [USER] 1 crash in Mail at -[WebViewEditor webView:shouldInsertText:replacingDOMRange:givenAction:]

        * editing/inserting/5418891.html: Added.
        * platform/mac/editing/inserting: Added.
        * platform/mac/editing/inserting/5418891-expected.checksum: Added.
        * platform/mac/editing/inserting/5418891-expected.png: Added.
        * platform/mac/editing/inserting/5418891-expected.txt: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@25192 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index fdfc4ae99cf7671161e9e49c8cfd15c6b9611e7a..8909c3f46e3ec34cf2df8bf9dbddd25a05dfc008 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,15 @@
+2007-08-22  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Adam.
+
+        <rdar://problem/5418891> CrashTracer: [USER] 1 crash in Mail at -[WebViewEditor webView:shouldInsertText:replacingDOMRange:givenAction:]
+
+        * editing/inserting/5418891.html: Added.
+        * platform/mac/editing/inserting: Added.
+        * platform/mac/editing/inserting/5418891-expected.checksum: Added.
+        * platform/mac/editing/inserting/5418891-expected.png: Added.
+        * platform/mac/editing/inserting/5418891-expected.txt: Added.
+
 2007-08-22  Kevin McCullough  <kmccullough@apple.com>
 
         Reviewed by Adele.

diff --git a/LayoutTests/editing/inserting/5418891.html b/LayoutTests/editing/inserting/5418891.html
new file mode 100644 (file)
index 0000000..7e7cadb
--- /dev/null
+++ b/LayoutTests/editing/inserting/5418891.html
@@ -0,0 +1,22 @@
+<style>
+blockquote {
+    color: blue;
+    border-left: 2px solid blue;
+    padding-left: 5px;
+    margin: 0px;
+}
+</style>
+<p>This tests for a crash when attempting to break a blockquote at the end of its content.  The caret should be in the first of two empty paragraphs between two pieces of quoted content.</p>
+<div contenteditable="true">
+<blockquote type="cite"><table border="1"><tr><td id="td">foo</td></tr></table></blockquote>
+<br>
+<blockquote type="cite"><table border="1"><tr><td>bar</td></tr></table></blockquote>
+</div>
+
+<script>
+td = document.getElementById("td");
+text = td.firstChild;
+s = window.getSelection();
+s.setPosition(text, 3);
+document.execCommand("InsertNewlineInQuotedContent");
+</script>

diff --git a/LayoutTests/platform/mac/editing/inserting/5418891-expected.checksum b/LayoutTests/platform/mac/editing/inserting/5418891-expected.checksum
new file mode 100644 (file)
index 0000000..7e38615
--- /dev/null
+++ b/LayoutTests/platform/mac/editing/inserting/5418891-expected.checksum
@@ -0,0 +1 @@
+bacb94ae8fe13fe441cdf48b1834da61
\ No newline at end of file

diff --git a/LayoutTests/platform/mac/editing/inserting/5418891-expected.png b/LayoutTests/platform/mac/editing/inserting/5418891-expected.png
new file mode 100644 (file)
index 0000000..ec6fb1c
Binary files /dev/null and b/LayoutTests/platform/mac/editing/inserting/5418891-expected.png differ

diff --git a/LayoutTests/platform/mac/editing/inserting/5418891-expected.txt b/LayoutTests/platform/mac/editing/inserting/5418891-expected.txt
new file mode 100644 (file)
index 0000000..3188ce3
--- /dev/null
+++ b/LayoutTests/platform/mac/editing/inserting/5418891-expected.txt
@@ -0,0 +1,29 @@
+layer at (0,0) size 800x600
+  RenderView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  RenderBlock {HTML} at (0,0) size 800x600
+    RenderBody {BODY} at (8,8) size 784x584
+      RenderBlock {P} at (0,0) size 784x36
+        RenderText {#text} at (0,0) size 772x36
+          text run at (0,0) width 536: "This tests for a crash when attempting to break a blockquote at the end of its content. "
+          text run at (536,0) width 236: "The caret should be in the first of two"
+          text run at (0,18) width 358: "empty paragraphs between two pieces of quoted content."
+      RenderBlock {DIV} at (0,52) size 784x92
+        RenderBlock {BLOCKQUOTE} at (0,0) size 784x28 [color=#0000FF] [border: (2px solid #0000FF)]
+          RenderTable {TABLE} at (7,0) size 31x28 [color=#000000] [border: (1px outset #808080)]
+            RenderTableSection {TBODY} at (1,1) size 29x26
+              RenderTableRow {TR} at (0,2) size 29x22
+                RenderTableCell {TD} at (2,2) size 25x22 [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=1]
+                  RenderText {#text} at (2,2) size 21x18
+                    text run at (2,2) width 21: "foo"
+        RenderBlock (anonymous) at (0,28) size 784x36
+          RenderBR {BR} at (0,0) size 0x18
+          RenderBR {BR} at (0,18) size 0x18
+        RenderBlock {BLOCKQUOTE} at (0,64) size 784x28 [color=#0000FF] [border: (2px solid #0000FF)]
+          RenderTable {TABLE} at (7,0) size 30x28 [color=#000000] [border: (1px outset #808080)]
+            RenderTableSection {TBODY} at (1,1) size 28x26
+              RenderTableRow {TR} at (0,2) size 28x22
+                RenderTableCell {TD} at (2,2) size 24x22 [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=1]
+                  RenderText {#text} at (2,2) size 20x18
+                    text run at (2,2) width 20: "bar"
+caret: position 0 of child 2 {BR} of child 2 {DIV} of child 1 {BODY} of child 0 {HTML} of document

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 40740c3c99adc953ad6b67315a5f4aeae648414e..d2823c9ffc82689db302a190909b634be2858af9 100644 (file)
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,14 @@
+2007-08-22  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Adam.
+        
+        <rdar://problem/5418891> CrashTracer: [USER] 1 crash in Mail at -[WebViewEditor webView:shouldInsertText:replacingDOMRange:givenAction:]
+
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply): We're reusing the topBlockquote
+        variable.  Null it out first.  If there is no new topBlockquote and we don't null
+        it out first, we'll assume that there was a new one and crash.
+
 2007-08-22  Kevin McCullough  <kmccullough@apple.com>
 
         Reviewed by Adele.

diff --git a/WebCore/editing/BreakBlockquoteCommand.cpp b/WebCore/editing/BreakBlockquoteCommand.cpp
index 64a56db249aa7cd5231eda8bf8d0bafee0f9509a..0c56766b56fe6280f9226f93406b294e65b448d0 100644 (file)
--- a/WebCore/editing/BreakBlockquoteCommand.cpp
+++ b/WebCore/editing/BreakBlockquoteCommand.cpp
@@ -93,12 +93,15 @@ void BreakBlockquoteCommand::doApply()
         // If a new start node was determined, find a new top block quote.
         if (newStartNode) {
             startNode = newStartNode;
+            topBlockquote = 0;
             for (Node *node = startNode->parentNode(); node; node = node->parentNode()) {
                 if (isMailBlockquote(node))
                     topBlockquote = node;
             }
-            if (!topBlockquote || !topBlockquote->parentNode())
+            if (!topBlockquote || !topBlockquote->parentNode()) {
+                setEndingSelection(Selection(VisiblePosition(Position(startNode, 0))));
                 return;
+            }
         }
         
         // Build up list of ancestors in between the start node and the top blockquote.