WebCore:

        Reviewed by Adam Roben.

        - fix http://bugs.webkit.org/show_bug.cgi?id=15942
          REGRESSION: Selecting "Edit Html" tab in Blogger causes crash (Assertion failed: isRange())

        Test: editing/selection/cleared-by-relayout.html

        * editing/Selection.cpp:
        (WebCore::Selection::toRange): Check if the selection has been cleared
        by updating layout.

LayoutTests:

        Reviewed by Adam Roben.

        - test for http://bugs.webkit.org/show_bug.cgi?id=15942
          REGRESSION: Selecting "Edit Html" tab in Blogger causes crash (Assertion failed: isRange())

        * editing/selection/cleared-by-relayout-expected.txt: Added.
        * editing/selection/cleared-by-relayout.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@27706 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 30538327612dcc0e3b0921023dee51ced754be98..6b356f8ccfd1467c9d90e50df8c63a155c1bee82 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2007-11-11  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Adam Roben.
+
+        - test for http://bugs.webkit.org/show_bug.cgi?id=15942
+          REGRESSION: Selecting "Edit Html" tab in Blogger causes crash (Assertion failed: isRange())
+
+        * editing/selection/cleared-by-relayout-expected.txt: Added.
+        * editing/selection/cleared-by-relayout.html: Added.
+
 2007-11-11  Antti Koivisto  <antti@apple.com>
 
         Reviewed by Darin.

diff --git a/LayoutTests/editing/selection/cleared-by-relayout-expected.txt b/LayoutTests/editing/selection/cleared-by-relayout-expected.txt
new file mode 100644 (file)
index 0000000..ab05604
--- /dev/null
+++ b/LayoutTests/editing/selection/cleared-by-relayout-expected.txt
@@ -0,0 +1,3 @@
+Test for http://bugs.webkit.org/show_bug.cgi?id=15942 REGRESSION: Selecting "Edit Html" tab in Blogger causes crash (Assertion failed: isRange()).
+
+

diff --git a/LayoutTests/editing/selection/cleared-by-relayout.html b/LayoutTests/editing/selection/cleared-by-relayout.html
new file mode 100644 (file)
index 0000000..7826123
--- /dev/null
+++ b/LayoutTests/editing/selection/cleared-by-relayout.html
@@ -0,0 +1,26 @@
+<p>
+    Test for <i><a href="http://bugs.webkit.org/show_bug.cgi?id=15942">http://bugs.webkit.org/show_bug.cgi?id=15942</a>
+    REGRESSION: Selecting "Edit Html" tab in Blogger causes crash (Assertion failed: isRange())</i>.
+</p>
+<p>
+    <iframe onload="prepare()" id="target" src="data:text/html,&lt;body contenteditable&gt;"></iframe>
+</p>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    var target = document.getElementById('target');
+    function prepare()
+    {
+        var doc = target.contentDocument;
+        target.contentWindow.getSelection().setPosition(doc.body, 0);
+        target.focus();
+        test();
+    }
+
+    function test()
+    {
+        target.style.display = 'none';
+        target.contentDocument.body.innerHTML;
+    }
+</script>

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 6fb558eab33a2cbe43232d496f2acf48a0825c33..72c10c84fcab99d0ad26def2ee0a35099a0ec957 100644 (file)
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,16 @@
+2007-11-11  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Adam Roben.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=15942
+          REGRESSION: Selecting "Edit Html" tab in Blogger causes crash (Assertion failed: isRange())
+
+        Test: editing/selection/cleared-by-relayout.html
+
+        * editing/Selection.cpp:
+        (WebCore::Selection::toRange): Check if the selection has been cleared
+        by updating layout.
+
 2007-11-11  Darin Adler  <darin@apple.com>
 
         Reviewed by Mark Rowe.

diff --git a/WebCore/editing/Selection.cpp b/WebCore/editing/Selection.cpp
index c7993359363cc80b3315689c3f317fe6c4333a66..32f650070888bf3ca9b2ac626b56038a9261cca5 100644 (file)
--- a/WebCore/editing/Selection.cpp
+++ b/WebCore/editing/Selection.cpp
@@ -129,6 +129,10 @@ PassRefPtr<Range> Selection::toRange() const
     // incorrect results.
     m_start.node()->document()->updateLayout();
 
+    // Check again, because updating layout can clear the selection.
+    if (isNone())
+        return 0;
+
     Position s, e;
     if (isCaret()) {
         // If the selection is a caret, move the range start upstream. This helps us match