LayoutTests:

        Reviewed by sullivan

        <rdar://problem/4845371>
        In Mail, a crash occurs at WebCore::Node::traverseNextNode() when cutting selected text from a HTML message

        * editing/deleting/4845371-expected.checksum: Added.
        * editing/deleting/4845371-expected.png: Added.
        * editing/deleting/4845371-expected.txt: Added.
        * editing/deleting/4845371.html: Added.

WebCore:

        Reviewed by sullivan

        <rdar://problem/4845371>
        In Mail, a crash occurs at WebCore::Node::traverseNextNode() when cutting selected text from a HTML message

        * editing/DeleteSelectionCommand.cpp:
        (WebCore::DeleteSelectionCommand::initializeStartEnd): The start/end were
        being inflated even when they were the start/end of a partially selected
        special element.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@17936 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 7ee799dfab585e5250b8ac6e1d1ed461273f58a6..81f6482c637857907e49b3df640941e649ad5499 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,15 @@
+2006-11-29  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by sullivan
+        
+        <rdar://problem/4845371>
+        In Mail, a crash occurs at WebCore::Node::traverseNextNode() when cutting selected text from a HTML message
+
+        * editing/deleting/4845371-expected.checksum: Added.
+        * editing/deleting/4845371-expected.png: Added.
+        * editing/deleting/4845371-expected.txt: Added.
+        * editing/deleting/4845371.html: Added.
+
 2006-11-28  David Harrison  <harrison@apple.com>
 
         Reviewed by Adele.

diff --git a/LayoutTests/editing/deleting/4845371-expected.checksum b/LayoutTests/editing/deleting/4845371-expected.checksum
new file mode 100644 (file)
index 0000000..354f06f
--- /dev/null
+++ b/LayoutTests/editing/deleting/4845371-expected.checksum
@@ -0,0 +1 @@
+774af8ecc2ec6463f3c453f0044f6acd
\ No newline at end of file

diff --git a/LayoutTests/editing/deleting/4845371-expected.png b/LayoutTests/editing/deleting/4845371-expected.png
new file mode 100644 (file)
index 0000000..052be60
Binary files /dev/null and b/LayoutTests/editing/deleting/4845371-expected.png differ

diff --git a/LayoutTests/editing/deleting/4845371-expected.txt b/LayoutTests/editing/deleting/4845371-expected.txt
new file mode 100644 (file)
index 0000000..5247858
--- /dev/null
+++ b/LayoutTests/editing/deleting/4845371-expected.txt
@@ -0,0 +1,35 @@
+EDITING DELEGATE: shouldBeginEditingInDOMRange:range from 0 of DIV > BODY > HTML > #document to 1 of DIV > BODY > HTML > #document
+EDITING DELEGATE: webViewDidBeginEditing:WebViewDidBeginEditingNotification
+EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
+EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
+EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
+EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
+EDITING DELEGATE: shouldDeleteDOMRange:range from 0 of #text > TD > TR > TBODY > TABLE > DIV > BODY > HTML > #document to 3 of #text > A > TD > TR > TBODY > TABLE > DIV > BODY > HTML > #document
+EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
+EDITING DELEGATE: shouldChangeSelectedDOMRange:(null) toDOMRange:range from 0 of TD > TR > TBODY > TABLE > DIV > BODY > HTML > #document to 0 of TD > TR > TBODY > TABLE > DIV > BODY > HTML > #document affinity:NSSelectionAffinityDownstream stillSelecting:FALSE
+EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
+EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
+layer at (0,0) size 800x600
+  RenderView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  RenderBlock {HTML} at (0,0) size 800x600
+    RenderBody {BODY} at (8,8) size 784x584
+      RenderBlock {P} at (0,0) size 784x36
+        RenderText {#text} at (0,0) size 386x18
+          text run at (0,0) width 386: "This tests for a crasher when deleting contents of a table cell. "
+        RenderInline {B} at (0,0) size 741x36
+          RenderText {#text} at (386,0) size 741x36
+            text run at (386,0) width 105: "There is a bug. "
+            text run at (491,0) width 250: "A br is inserted in the table cell that's"
+            text run at (0,18) width 84: "emptied out."
+      RenderBlock {DIV} at (0,52) size 784x42
+        RenderTable {TABLE} at (0,0) size 32x42
+          RenderTableSection {TBODY} at (0,0) size 32x42
+            RenderTableRow {TR} at (0,2) size 32x38
+              RenderTableCell {TD} at (2,2) size 2x38 [r=0 c=0 rs=1 cs=1]
+                RenderBR {BR} at (1,1) size 0x18
+                RenderBR {BR} at (1,19) size 0x18
+              RenderTableCell {TD} at (6,11) size 24x20 [r=0 c=1 rs=1 cs=1]
+                RenderText {#text} at (1,1) size 22x18
+                  text run at (1,1) width 22: "baz"
+caret: position 0 of child 0 {BR} of child 0 {TD} of child 0 {TR} of child 0 {TBODY} of child 0 {TABLE} of child 2 {DIV} of child 0 {BODY} of child 0 {HTML} of document

diff --git a/LayoutTests/editing/deleting/4845371.html b/LayoutTests/editing/deleting/4845371.html
new file mode 100644 (file)
index 0000000..4c7b86a
--- /dev/null
+++ b/LayoutTests/editing/deleting/4845371.html
@@ -0,0 +1,18 @@
+<p>This tests for a crasher when deleting contents of a table cell. <b>There is a bug.  A br is inserted in the table cell that's emptied out.</b></p>
+<div id="div" contenteditable="true"><table><tr><td>foo <a href="http://www.google.com/">bar</a></td><td>baz</td></tr></table></div>
+
+<script type="Javascript" src="../editing.js"></script>
+<script>
+runEditingTest();
+
+function editingTest() {
+    var div = document.getElementById("div");
+    var sel = window.getSelection();
+
+    sel.setPosition(div, 0);
+    moveSelectionForwardByCharacterCommand();
+    extendSelectionForwardByWordCommand();
+    extendSelectionForwardByWordCommand();
+    deleteCommand();
+}
+</script>

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index e3a7101e5137b5830dcb69c14815883a80f8c1c4..24d6243ef03ce74fbbb0f0a7f8e4ae3852fd8dad 100644 (file)
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,15 @@
+2006-11-29  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by sullivan
+        
+        <rdar://problem/4845371>
+        In Mail, a crash occurs at WebCore::Node::traverseNextNode() when cutting selected text from a HTML message
+        
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::initializeStartEnd): The start/end were
+        being inflated even when they were the start/end of a partially selected
+        special element.
+
 2006-11-29  Anders Carlsson  <acarlsson@apple.com>
 
         Reviewed by Oliver.

diff --git a/WebCore/editing/DeleteSelectionCommand.cpp b/WebCore/editing/DeleteSelectionCommand.cpp
index 11e1414048a438a4c216a095b24cc320423e560a..c61101b951d070bdec9f2befb05ce238dd501fda 100644 (file)
--- a/WebCore/editing/DeleteSelectionCommand.cpp
+++ b/WebCore/editing/DeleteSelectionCommand.cpp
@@ -97,8 +97,18 @@ void DeleteSelectionCommand::initializeStartEnd()
         if (!startSpecialContainer || !endSpecialContainer)
             break;
         
-        start = s;
-        end = e;
+        if (startSpecialContainer->isDescendantOf(endSpecialContainer))
+            // Don't adjust the end yet, it is the end of a special element that contains the start
+            // special element (which may or may not be fully selected).
+            start = s;
+        else if (endSpecialContainer->isDescendantOf(startSpecialContainer))
+            // Don't adjust the start yet, it is the start of a special element that contains the end
+            // special element (which may or may not be fully selected).
+            end = e;
+        else {
+            start = s;
+            end = e;
+        }
     }
  
     m_upstreamStart = start.upstream();