2006-09-14 Graham Dennis <graham.dennis@gmail.com>

        Reviewed by Justin Garcia.

        - http://bugzilla.opendarwin.org/show_bug.cgi?id=10726
          Crash in ApplyStyleCommand::applyRelativeFontStyleChange

        * editing/ApplyStyleCommand.cpp:
        (WebCore::ApplyStyleCommand::applyRelativeFontStyleChange): Prevent a crash by
        makeing sure that the 'beyondEnd' node is after the start node.

2006-09-14  Graham Dennis  <graham.dennis@gmail.com>

        Reviewed by Justin Garcia.

        Modified testcase for:
        http://bugzilla.opendarwin.org/show_bug.cgi?id=10726
        Crash in ApplyStyleCommand::applyRelativeFontStyleChange

        * editing/style/table-selection-expected.checksum:
        * editing/style/table-selection-expected.png:
        * editing/style/table-selection-expected.txt:
        * editing/style/table-selection.html:
        This testcase was for 10579, which is very similar to this bug (10726)
        Now the testcase tests both bugs.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@16362 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 18696369034baaaa6cb36e925f4f0cca77c35bd9..b065da4b6681c10a910945fee27fd7c693cb2a4d 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,18 @@
+2006-09-14  Graham Dennis  <graham.dennis@gmail.com>
+
+        Reviewed by Justin Garcia.
+
+        Modified testcase for:
+        http://bugzilla.opendarwin.org/show_bug.cgi?id=10726
+        Crash in ApplyStyleCommand::applyRelativeFontStyleChange
+
+        * editing/style/table-selection-expected.checksum:
+        * editing/style/table-selection-expected.png:
+        * editing/style/table-selection-expected.txt:
+        * editing/style/table-selection.html:
+        This testcase was for 10579, which is very similar to this bug (10726)
+        Now the testcase tests both bugs.
+
 2006-09-13  Adam Roben  <aroben@apple.com>
 
         Rubberstamped by hyatt.

diff --git a/LayoutTests/editing/style/table-selection-expected.checksum b/LayoutTests/editing/style/table-selection-expected.checksum
index a573ec824914baa378915839cb1a978e9b9a4fb4..380c6eb3c312d773e295b473eac026bc0f0b2f95 100644 (file)
--- a/LayoutTests/editing/style/table-selection-expected.checksum
+++ b/LayoutTests/editing/style/table-selection-expected.checksum
@@ -1 +1 @@
-149cf71db7fafcb4a948a23d00b3a2ba
\ No newline at end of file
+edc344da0bfb3eb298897b46f60f30ac
\ No newline at end of file

diff --git a/LayoutTests/editing/style/table-selection-expected.png b/LayoutTests/editing/style/table-selection-expected.png
index 0bc6ce2c9b4ecce906688ce1edfc947fcb3cac5c..894403314c7893095e40b802dcc2f5eb3ac397d2 100644 (file)
Binary files a/LayoutTests/editing/style/table-selection-expected.png and b/LayoutTests/editing/style/table-selection-expected.png differ

diff --git a/LayoutTests/editing/style/table-selection-expected.txt b/LayoutTests/editing/style/table-selection-expected.txt
index 55c1e1c57414e53b46b406db5f7ea00cc4e19fb7..01892dcbb5fcc5842d77eebae17571e1c7c9ae55 100644 (file)
--- a/LayoutTests/editing/style/table-selection-expected.txt
+++ b/LayoutTests/editing/style/table-selection-expected.txt
@@ -6,21 +6,23 @@ EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotificatio
 EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
 EDITING DELEGATE: shouldChangeSelectedDOMRange:range from 1 of #text > TD > TR > TBODY > TABLE > DIV > BODY > HTML > #document to 2 of TABLE > DIV > BODY > HTML > #document toDOMRange:range from 1 of #text > TD > TR > TBODY > TABLE > DIV > BODY > HTML > #document to 2 of TABLE > DIV > BODY > HTML > #document affinity:NSSelectionAffinityDownstream stillSelecting:FALSE
 EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
+EDITING DELEGATE: shouldChangeSelectedDOMRange:range from 1 of #text > TD > TR > TBODY > TABLE > DIV > BODY > HTML > #document to 2 of TABLE > DIV > BODY > HTML > #document toDOMRange:range from 1 of #text > TD > TR > TBODY > TABLE > DIV > BODY > HTML > #document to 2 of TABLE > DIV > BODY > HTML > #document affinity:NSSelectionAffinityDownstream stillSelecting:FALSE
+EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
 layer at (0,0) size 800x600
   RenderView at (0,0) size 800x600
 layer at (0,0) size 800x600
   RenderBlock {HTML} at (0,0) size 800x600
     RenderBody {BODY} at (8,8) size 784x584
-      RenderBlock {DIV} at (0,0) size 784x74 [border: (2px solid #FF0000)]
-        RenderTable {TABLE} at (14,14) size 27x46
-          RenderTableSection {TBODY} at (0,0) size 27x46
-            RenderTableRow {TR} at (0,2) size 27x20
-              RenderTableCell {TD} at (2,2) size 23x20 [r=0 c=0 rs=1 cs=1]
-                RenderText {#text} at (1,1) size 21x18
-                  text run at (1,1) width 21: "foo"
-            RenderTableRow {TR} at (0,24) size 27x20
-              RenderTableCell {TD} at (2,24) size 23x20 [r=1 c=0 rs=1 cs=1]
-                RenderText {#text} at (1,1) size 20x18
-                  text run at (1,1) width 20: "bar"
+      RenderBlock {DIV} at (0,0) size 784x78 [border: (2px solid #FF0000)]
+        RenderTable {TABLE} at (14,14) size 30x50
+          RenderTableSection {TBODY} at (0,0) size 30x50
+            RenderTableRow {TR} at (0,2) size 30x22
+              RenderTableCell {TD} at (2,2) size 26x22 [r=0 c=0 rs=1 cs=1]
+                RenderText {#text} at (1,1) size 24x20
+                  text run at (1,1) width 24: "foo"
+            RenderTableRow {TR} at (0,26) size 30x22
+              RenderTableCell {TD} at (2,26) size 26x22 [r=1 c=0 rs=1 cs=1]
+                RenderText {#text} at (1,1) size 23x20
+                  text run at (1,1) width 23: "bar"
 selection start: position 1 of child 0 {#text} of child 0 {TD} of child 0 {TR} of child 1 {TBODY} of child 1 {TABLE} of child 1 {DIV} of child 1 {BODY} of child 0 {HTML} of document
 selection end:   position 2 of child 1 {TABLE} of child 1 {DIV} of child 1 {BODY} of child 0 {HTML} of document

diff --git a/LayoutTests/editing/style/table-selection.html b/LayoutTests/editing/style/table-selection.html
index 68f461997b3235b33da06d095e73b03de6d7c22f..a1958216dcec8ddc4054653453d82597b1ae39bf 100644 (file)
--- a/LayoutTests/editing/style/table-selection.html
+++ b/LayoutTests/editing/style/table-selection.html
@@ -18,6 +18,7 @@ function editingTest() {
     extendSelectionForwardByLineCommand();
     extendSelectionForwardByLineCommand();
     justifyCenterCommand();
+    fontSizeDeltaCommand();
 }
 
 </script>

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 0f6347c3ea97528be337a23d679e883f32f14991..fb71ed98a5fdb5c0c79bc255fbae333481f9c82b 100644 (file)
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,14 @@
+2006-09-14  Graham Dennis  <graham.dennis@gmail.com>
+
+        Reviewed by Justin Garcia.
+
+        - http://bugzilla.opendarwin.org/show_bug.cgi?id=10726
+          Crash in ApplyStyleCommand::applyRelativeFontStyleChange
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::applyRelativeFontStyleChange): Prevent a crash by
+        makeing sure that the 'beyondEnd' node is after the start node.
+
 2006-09-14  MorganL  <morlmor@yahoo.com>
 
         Reviewed by Brady.

diff --git a/WebCore/editing/ApplyStyleCommand.cpp b/WebCore/editing/ApplyStyleCommand.cpp
index d650218e96cd5e1e904ca8e36f647afd5004971b..288920d19eecdd7c371bfcaccda11192c2db1d11 100644 (file)
--- a/WebCore/editing/ApplyStyleCommand.cpp
+++ b/WebCore/editing/ApplyStyleCommand.cpp
@@ -471,7 +471,15 @@ void ApplyStyleCommand::applyRelativeFontStyleChange(CSSMutableStyleDeclaration
         end = endPosition();
     }
 
-    Node *beyondEnd = end.node()->traverseNextNode(); // Calculate loop end point.
+    // Calculate loop end point.
+    // If the end node is before the start node (can only happen if the end node is
+    // an ancestor of the start node), we gather nodes up to the next sibling of the end node
+    Node *beyondEnd;
+    if (start.node()->isAncestor(end.node()))
+        beyondEnd = end.node()->traverseNextSibling();
+    else
+        beyondEnd = end.node()->traverseNextNode();
+    
     start = start.upstream(); // Move upstream to ensure we do not add redundant spans.
     Node *startNode = start.node();
     if (startNode->isTextNode() && start.offset() >= startNode->caretMaxOffset()) // Move out of text node if range does not include its characters.