Source/WebCore: Crash in DeleteSelectionCommand::handleGeneralDelete when attempting...
authorrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 31 Jan 2012 20:41:05 +0000 (20:41 +0000)
committerrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 31 Jan 2012 20:41:05 +0000 (20:41 +0000)
https://bugs.webkit.org/show_bug.cgi?id=77077

Reviewed by Enrica Casucci.

The crash was caused by a missing null check after removing the position out of the start block.
Fixed the bug by adding an early return.

Tests: editing/deleting/delete-start-block.html
       editing/selection/move-into-empty-root-inline-box.html

* editing/DeleteSelectionCommand.cpp:
(WebCore::DeleteSelectionCommand::handleGeneralDelete):

LayoutTests: Crash in previousLinePosition when moving into a root inline box without leaves
https://bugs.webkit.org/show_bug.cgi?id=76812

Reviewed by Enrica Casucci.

Add a regression test for the crash. Unfortunately, we can only test previousLinePosition.

* editing/selection/move-into-empty-root-inline-box-expected.txt: Added.
* editing/selection/move-into-empty-root-inline-box.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@106380 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/editing/deleting/delete-start-block-expected.txt [new file with mode: 0644]
LayoutTests/editing/deleting/delete-start-block.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/editing/DeleteSelectionCommand.cpp

index 3cf0a79f3505456e1e44c6a58d7b012d3a3717fe..c671fab8013c2832fdff8acb1508c0e1839cc0f1 100644 (file)
@@ -1,3 +1,15 @@
+2012-01-31  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Crash in previousLinePosition when moving into a root inline box without leaves
+        https://bugs.webkit.org/show_bug.cgi?id=76812
+
+        Reviewed by Enrica Casucci.
+
+        Add a regression test for the crash. Unfortunately, we can only test previousLinePosition.
+
+        * editing/selection/move-into-empty-root-inline-box-expected.txt: Added.
+        * editing/selection/move-into-empty-root-inline-box.html: Added.
+
 2012-01-31  Tony Chang  <tony@chromium.org>
 
         [chromium] Fix css3/flexbox/cross-axis-scrollbar-expected to work on
diff --git a/LayoutTests/editing/deleting/delete-start-block-expected.txt b/LayoutTests/editing/deleting/delete-start-block-expected.txt
new file mode 100644 (file)
index 0000000..9626dee
--- /dev/null
@@ -0,0 +1,5 @@
+This tests removing the start block. WebKit should not crash.
+| <div>
+|   <br>
+| <br>
+| <br>
diff --git a/LayoutTests/editing/deleting/delete-start-block.html b/LayoutTests/editing/deleting/delete-start-block.html
new file mode 100644 (file)
index 0000000..a11faf5
--- /dev/null
@@ -0,0 +1,15 @@
+><progress><script src="../../resources/dump-as-markup.js"></script><script>
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+document.designMode="on";
+document.execCommand("selectall");
+document.execCommand("justifycenter",false);
+document.body.removeChild(document.body.firstElementChild);
+document.execCommand("insertparagraph");
+
+Markup.description("This tests removing the start block. WebKit should not crash.");
+Markup.dump(document.body);
+
+</script>
index f9f8e5536c5176c94ad5d62db1a2b86d76d66fb4..2cb5e45fc0024911c74861ab1e7e73936f75483e 100644 (file)
@@ -1,3 +1,19 @@
+2012-01-31  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Crash in DeleteSelectionCommand::handleGeneralDelete when attempting to delete the start block
+        https://bugs.webkit.org/show_bug.cgi?id=77077
+
+        Reviewed by Enrica Casucci.
+
+        The crash was caused by a missing null check after removing the position out of the start block.
+        Fixed the bug by adding an early return.
+
+        Tests: editing/deleting/delete-start-block.html
+               editing/selection/move-into-empty-root-inline-box.html
+
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::handleGeneralDelete):
+
 2012-01-31  Rafael Brandao  <rafael.lobo@openbossa.org>
 
         HTMLIsIndexElement should not expose HTMLInputElement properties
index 27f679f6dbb86a15bb6e75bd171608edb7ca241d..839b73420242027ab5d4f5871fc9b455ea513ba7 100644 (file)
@@ -418,6 +418,8 @@ void DeleteSelectionCommand::handleGeneralDelete()
     if (startNode == m_startBlock && startOffset == 0 && canHaveChildrenForEditing(startNode) && !startNode->hasTagName(tableTag)) {
         startOffset = 0;
         startNode = startNode->traverseNextNode();
+        if (!startNode)
+            return;
     }
 
     if (startOffset >= caretMaxOffset(startNode) && startNode->isTextNode()) {