Mail.app crashes when indenting table pasted from Numbers.app.
authorenrica@apple.com <enrica@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 4 Dec 2009 19:49:37 +0000 (19:49 +0000)
committerenrica@apple.com <enrica@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 4 Dec 2009 19:49:37 +0000 (19:49 +0000)
<rdar://problem/7209507>
https://bugs.webkit.org/show_bug.cgi?id=32166

Reviewed by John Sullivan.

WebCore:

Test: LayoutTests/editing/execCommand/indent-partial-table.html

* editing/IndentOutdentCommand.cpp:
(WebCore::IndentOutdentCommand::indentRegion): Added test to verify that the end of the paragraph
after the selection has not been moved.

LayoutTests:

* editing/execCommand/indent-partial-table-expected.txt: Added.
* editing/execCommand/indent-partial-table.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@51704 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/editing/execCommand/indent-partial-table-expected.txt [new file with mode: 0644]
LayoutTests/editing/execCommand/indent-partial-table.html [new file with mode: 0644]
WebCore/ChangeLog
WebCore/editing/IndentOutdentCommand.cpp

index 992a69bfa528edd28d0aaf51aa9d9809aeed0ac0..b985c7a10c78b99fa22791d40e90b1b350d16473 100644 (file)
@@ -1,3 +1,14 @@
+2009-12-04  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Mail.app crashes when indenting table pasted from Numbers.app.
+        <rdar://problem/7209507>
+        https://bugs.webkit.org/show_bug.cgi?id=32166
+
+        * editing/execCommand/indent-partial-table-expected.txt: Added.
+        * editing/execCommand/indent-partial-table.html: Added.
+
 2009-12-04  Alexey Proskuryakov  <ap@apple.com>
 
         Reviewed by Darin Adler.
diff --git a/LayoutTests/editing/execCommand/indent-partial-table-expected.txt b/LayoutTests/editing/execCommand/indent-partial-table-expected.txt
new file mode 100644 (file)
index 0000000..316c912
--- /dev/null
@@ -0,0 +1,10 @@
+This tests for a crash when indenting a table that is not entirely selected.
+
+
+
+One    Two
+Three  Four
+
+
+
+
diff --git a/LayoutTests/editing/execCommand/indent-partial-table.html b/LayoutTests/editing/execCommand/indent-partial-table.html
new file mode 100644 (file)
index 0000000..b53a04f
--- /dev/null
@@ -0,0 +1,27 @@
+<p>This tests for a crash when indenting a table that is not entirely selected.</p>
+<div contenteditable="true" id="test">
+    <div><br></div>
+    <div id="start"><br></div>
+        <table border="1">
+            <tbody> 
+                <tr id="firstrow">
+                 <td>One</td>
+                 <td>Two</td>
+                 </tr>
+                <tr id="secondrow">
+                 <td>Three</td>
+                 <td>Four</td>
+                </tr>
+            </tbody>
+        </table> 
+        <br>
+    <div><br></div>
+    <div><br></div>
+</div>
+<script>
+if (window.layoutTestController)
+    window.layoutTestController.dumpAsText();
+indent = document.getElementById("secondrow");
+window.getSelection().setBaseAndExtent(document.getElementById('start'), 0, indent, 0);
+document.execCommand("indent");
+</script>
index c6c3fc26f02bf8baba92173c95c2620441793514..695498fc695fa28ef1fa9a3252d4c975742b821a 100644 (file)
@@ -1,3 +1,17 @@
+2009-12-04  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Mail.app crashes when indenting table pasted from Numbers.app.
+        <rdar://problem/7209507>
+        https://bugs.webkit.org/show_bug.cgi?id=32166
+
+        Test: LayoutTests/editing/execCommand/indent-partial-table.html
+        
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::indentRegion): Added test to verify that the end of the paragraph
+        after the selection has not been moved.
+
 2009-12-04  Alexey Proskuryakov  <ap@apple.com>
 
         Reviewed by Darin Adler.
index 109879142d625a2fe46a9f8e3d63741956d36662..5e6f339423ba0c3d1ca622cea0543e2331cef629 100644 (file)
@@ -153,6 +153,12 @@ void IndentOutdentCommand::indentRegion(const VisiblePosition& startOfSelection,
             blockquoteForNextIndent = 0;
         else
             indentIntoBlockquote(endOfCurrentParagraph, endOfNextParagraph, blockquoteForNextIndent);
+
+        // indentIntoBlockquote could move more than one paragraph if the paragraph
+        // is in a list item or a table. As a result, endAfterSelection could refer to a position
+        // no longer in the document.
+        if (endAfterSelection.isNotNull() && !endAfterSelection.deepEquivalent().node()->inDocument())
+            break;
         // Sanity check: Make sure our moveParagraph calls didn't remove endOfNextParagraph.deepEquivalent().node()
         // If somehow we did, return to prevent crashes.
         if (endOfNextParagraph.isNotNull() && !endOfNextParagraph.deepEquivalent().node()->inDocument()) {