2011-05-24 Leo Yang <leo.yang@torchmobile.com.cn>
authorleo.yang@torchmobile.com.cn <leo.yang@torchmobile.com.cn@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 25 May 2011 01:26:53 +0000 (01:26 +0000)
committerleo.yang@torchmobile.com.cn <leo.yang@torchmobile.com.cn@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 25 May 2011 01:26:53 +0000 (01:26 +0000)
        Reviewed by Ryosuke Niwa.

        [SVG] Assertion failure by dragging text between input fields inside <foreignObject>s
        https://bugs.webkit.org/show_bug.cgi?id=60692

        Add NULL check of 'holder' in WebCore::ReplacementFragment::ReplacementFragment()
        before call VisibleSelection::selectionFromContentsOfNode() to prevent crashing.

        Test: editing/pasteboard/drag-drop-input-in-svg.svg

        * editing/ReplaceSelectionCommand.cpp:
        (WebCore::ReplacementFragment::ReplacementFragment):
2011-05-24  Leo Yang  <leo.yang@torchmobile.com.cn>

        Reviewed by Ryosuke Niwa.

        [SVG] Assertion failure by dragging text between input fields inside <foreignObject>s
        https://bugs.webkit.org/show_bug.cgi?id=60692

        Test case to verify dragging and dropping text between input fields
        inside SVG <foreignObject>s. Test passes if no crash occurs in debug mode.

        Drag and drop is not supported in Qt DRT, so skip this case on Qt platform.

        * editing/pasteboard/drag-drop-input-in-svg-expected.txt: Added.
        * editing/pasteboard/drag-drop-input-in-svg.svg: Added.
        * platform/qt/Skipped:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@87248 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/editing/pasteboard/drag-drop-input-in-svg-expected.txt [new file with mode: 0644]
LayoutTests/editing/pasteboard/drag-drop-input-in-svg.svg [new file with mode: 0644]
LayoutTests/platform/qt/Skipped
Source/WebCore/ChangeLog
Source/WebCore/editing/ReplaceSelectionCommand.cpp

index e1fb9ec02e3447c0a974f0f1d03b439c05776058..86d1fe121ef071247721c5e6a5d49cc8517d697c 100644 (file)
@@ -1,3 +1,19 @@
+2011-05-24  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        Reviewed by Ryosuke Niwa.
+
+        [SVG] Assertion failure by dragging text between input fields inside <foreignObject>s
+        https://bugs.webkit.org/show_bug.cgi?id=60692
+
+        Test case to verify dragging and dropping text between input fields
+        inside SVG <foreignObject>s. Test passes if no crash occurs in debug mode.
+
+        Drag and drop is not supported in Qt DRT, so skip this case on Qt platform.
+
+        * editing/pasteboard/drag-drop-input-in-svg-expected.txt: Added.
+        * editing/pasteboard/drag-drop-input-in-svg.svg: Added.
+        * platform/qt/Skipped:
+
 2011-05-24  Ryosuke Niwa  <rniwa@webkit.org>
 
         Yet another attempt to make Chromium Windows test bots happy.
 2011-05-24  Ryosuke Niwa  <rniwa@webkit.org>
 
         Yet another attempt to make Chromium Windows test bots happy.
diff --git a/LayoutTests/editing/pasteboard/drag-drop-input-in-svg-expected.txt b/LayoutTests/editing/pasteboard/drag-drop-input-in-svg-expected.txt
new file mode 100644 (file)
index 0000000..c05c235
--- /dev/null
@@ -0,0 +1 @@
+PASS without crash in Debug mode.
diff --git a/LayoutTests/editing/pasteboard/drag-drop-input-in-svg.svg b/LayoutTests/editing/pasteboard/drag-drop-input-in-svg.svg
new file mode 100644 (file)
index 0000000..7f94e9c
--- /dev/null
@@ -0,0 +1,41 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     xmlns:xhtml="http://www.w3.org/1999/xhtml">
+<foreignObject width="200" height="80">
+    <xhtml:div>
+        <xhtml:input id="src" type="text" value="Select and drag this text"></xhtml:input>
+        <xhtml:input id="dst" type="text" value="to here"></xhtml:input>
+    </xhtml:div>
+</foreignObject>
+<text>PASS without crash in Debug mode.</text>
+<script>
+(function runTest()
+{
+    if (!window.layoutTestController)
+        return;
+
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+
+    var sourceInput = document.getElementById("src");
+    sourceInput.focus();
+    sourceInput.setSelectionRange(0, 6);
+    var x = sourceInput.offsetLeft + 10;
+    var y = sourceInput.offsetTop + sourceInput.offsetHeight / 2;
+    eventSender.mouseMoveTo(x, y);
+    eventSender.mouseDown();
+
+    eventSender.leapForward(500);
+
+    var destinationInput = document.getElementById("dst");
+    eventSender.mouseMoveTo(destinationInput.offsetLeft + 10, destinationInput.offsetTop + destinationInput.offsetHeight / 2);
+    eventSender.mouseUp();
+
+    sourceInput.parentNode.removeChild(sourceInput);
+    destinationInput.parentNode.removeChild(destinationInput);
+
+    layoutTestController.notifyDone();
+})();
+</script>
+</svg>
index 2705d5abaee1535e899fb6d4c4396467961cce7f..6754eb675c11a9c96b093012ff44ab8889106751 100644 (file)
@@ -144,6 +144,7 @@ editing/pasteboard/4947130.html
 editing/pasteboard/copy-standalone-image.html
 editing/pasteboard/drag-drop-dead-frame.html
 editing/pasteboard/drag-drop-input-textarea.html
 editing/pasteboard/copy-standalone-image.html
 editing/pasteboard/drag-drop-dead-frame.html
 editing/pasteboard/drag-drop-input-textarea.html
+editing/pasteboard/drag-drop-input-in-svg.svg
 editing/pasteboard/drag-drop-iframe-refresh-crash.html
 editing/pasteboard/drag-drop-modifies-page.html
 editing/pasteboard/drag-drop-url-text.html
 editing/pasteboard/drag-drop-iframe-refresh-crash.html
 editing/pasteboard/drag-drop-modifies-page.html
 editing/pasteboard/drag-drop-url-text.html
index 32238dbe7a47b3685bd913566045a1db0f695d1e..1ac6ac3eff839295427250873859bb0b33642137 100644 (file)
@@ -1,3 +1,18 @@
+2011-05-24  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        Reviewed by Ryosuke Niwa.
+
+        [SVG] Assertion failure by dragging text between input fields inside <foreignObject>s
+        https://bugs.webkit.org/show_bug.cgi?id=60692
+
+        Add NULL check of 'holder' in WebCore::ReplacementFragment::ReplacementFragment()
+        before call VisibleSelection::selectionFromContentsOfNode() to prevent crashing.
+
+        Test: editing/pasteboard/drag-drop-input-in-svg.svg
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplacementFragment::ReplacementFragment):
+
 2011-05-24  Andy Estes  <aestes@apple.com>
 
         Reviewed by Geoffrey Garen.
 2011-05-24  Andy Estes  <aestes@apple.com>
 
         Reviewed by Geoffrey Garen.
index a7c79f977f930c093e29623894fef6e61897efd4..0eb6b1bcff1a28a47c8544a105a4df5abc5e8689 100644 (file)
@@ -156,6 +156,10 @@ ReplacementFragment::ReplacementFragment(Document* document, DocumentFragment* f
 
     Node* styleNode = selection.base().deprecatedNode();
     RefPtr<StyledElement> holder = insertFragmentForTestRendering(styleNode);
 
     Node* styleNode = selection.base().deprecatedNode();
     RefPtr<StyledElement> holder = insertFragmentForTestRendering(styleNode);
+    if (!holder) {
+        removeInterchangeNodes(m_fragment.get());
+        return;
+    }
     
     RefPtr<Range> range = VisibleSelection::selectionFromContentsOfNode(holder.get()).toNormalizedRange();
     String text = plainText(range.get());
     
     RefPtr<Range> range = VisibleSelection::selectionFromContentsOfNode(holder.get()).toNormalizedRange();
     String text = plainText(range.get());