<rdar://problem/10232866> Assertion failure beneath blockSelectionGaps() when a selec...

Reviewed by Ryosuke Niwa.

Source/WebCore:

Test: editing/selection/invalid-in-RenderView.html

* editing/FrameSelection.cpp:
(WebCore::FrameSelection::updateAppearance): Ensure that the VisibleSelection used to set the selection
in the RenderView is valid, by reconstructing it from the current selection.

LayoutTests:

* editing/selection/invalid-in-RenderView-expected.txt: Added.
* editing/selection/invalid-in-RenderView.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@96834 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index f2e589168b6c9b9f60ee683777006c20e27a37f2..7dc4c5e5f3a556434ab88cd469f583eaa8f8959a 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,12 @@
+2011-10-06  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/10232866> Assertion failure beneath blockSelectionGaps() when a selected node is removed
+
+        Reviewed by Ryosuke Niwa.
+
+        * editing/selection/invalid-in-RenderView-expected.txt: Added.
+        * editing/selection/invalid-in-RenderView.html: Added.
+
 2011-10-06  Alejandro G. Castro  <alex@igalia.com>
 
         [WK2] [GTK] Add Skipped file for Webkit2 test runner

diff --git a/LayoutTests/editing/selection/invalid-in-RenderView-expected.txt b/LayoutTests/editing/selection/invalid-in-RenderView-expected.txt
new file mode 100644 (file)
index 0000000..8b13789
--- /dev/null
+++ b/LayoutTests/editing/selection/invalid-in-RenderView-expected.txt
@@ -0,0 +1 @@
+

diff --git a/LayoutTests/editing/selection/invalid-in-RenderView.html b/LayoutTests/editing/selection/invalid-in-RenderView.html
new file mode 100644 (file)
index 0000000..7213488
--- /dev/null
+++ b/LayoutTests/editing/selection/invalid-in-RenderView.html
@@ -0,0 +1,21 @@
+<script>
+    var frameset;
+    var topFrame;
+    var selection;
+
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    onload = function()
+    {
+        frameset = document.getElementById("frameset");
+        topFrame = document.getElementById("topFrame");
+        selection = getSelection();
+        selection.setBaseAndExtent(frameset.parentNode, 0, frameset, 4);
+        topFrame.parentNode.removeChild(topFrame);
+    }
+</script>
+<frameset id="frameset">
+    <frame id="topFrame"/>
+    <frame/>
+</frameset>

diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 24e3696fd6d680e2cc0196bb348151a1350e8ede..22597a03945eb27b301a0e6c8f4d43edd60a6953 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,15 @@
+2011-10-06  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/10232866> Assertion failure beneath blockSelectionGaps() when a selected node is removed
+
+        Reviewed by Ryosuke Niwa.
+
+        Test: editing/selection/invalid-in-RenderView.html
+
+        * editing/FrameSelection.cpp:
+        (WebCore::FrameSelection::updateAppearance): Ensure that the VisibleSelection used to set the selection
+        in the RenderView is valid, by reconstructing it from the current selection.
+
 2011-10-06  Andreas Kling  <kling@webkit.org>
 
         InlineBox's virtualLogicalHeight() partially limited to builds with SVG.

diff --git a/Source/WebCore/editing/FrameSelection.cpp b/Source/WebCore/editing/FrameSelection.cpp
index 9a17ce453a27240b59c1528cabd7f646a38dacfa..32c6b78d57bc01d41ff1efb680634ec68a1cad9d 100644 (file)
--- a/Source/WebCore/editing/FrameSelection.cpp
+++ b/Source/WebCore/editing/FrameSelection.cpp
@@ -1680,7 +1680,7 @@ void FrameSelection::updateAppearance()
     if (!view)
         return;
 
-    VisibleSelection selection = this->selection();
+    VisibleSelection selection(m_selection.visibleStart(), m_selection.visibleEnd());
 
     if (!selection.isRange()) {
         view->clearSelection();