WebCore:

        Reviewed by Adele Peterson.

        <rdar://problem/5497643> Crash at Node::isDescendantOf when switching out of Edit HTML Source mode

        A textarea that contained the selection was removed but the selection wasn't cleared,
        and we'd crash in code that assumed a valid, in-document selection.

        * editing/SelectionController.cpp:
        (WebCore::removingNodeRemovesPosition): Clear the selection if the node being removed is the
        shadowAncestorNode of the node that contains the position, not just if the node being removed
        contains that shadowAncestorNode.

LayoutTests:

        Reviewed by Adele Peterson.

        <rdar://problem/5497643> Crash at Node::isDescendantOf when switching out of Edit HTML Source mode

        * editing/selection/5497643-expected.txt: Added.
        * editing/selection/5497643.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@27818 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 4f77a1ff59ca25fdc7edae711544c26ddde693e9..dd9facec5f3b2fc057c904f2a3dca91c55e8ca48 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,12 @@
+2007-11-15  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/5497643> Crash at Node::isDescendantOf when switching out of Edit HTML Source mode
+
+        * editing/selection/5497643-expected.txt: Added.
+        * editing/selection/5497643.html: Added.
+
 2007-11-14  Anders Carlsson  <andersca@apple.com>
 
         Reviewed by Brady.

diff --git a/LayoutTests/editing/selection/5497643-expected.txt b/LayoutTests/editing/selection/5497643-expected.txt
new file mode 100644 (file)
index 0000000..8de6258
--- /dev/null
+++ b/LayoutTests/editing/selection/5497643-expected.txt
@@ -0,0 +1,4 @@
+ALERT: SUCCESS: The selection was cleared.
+This tests to make sure that a selection inside a textarea is cleared when the textarea is removed from the document. Not clearing it led to crashes.
+
+

diff --git a/LayoutTests/editing/selection/5497643.html b/LayoutTests/editing/selection/5497643.html
new file mode 100644 (file)
index 0000000..3d2af77
--- /dev/null
+++ b/LayoutTests/editing/selection/5497643.html
@@ -0,0 +1,13 @@
+<p>This tests to make sure that a selection inside a textarea is cleared when the textarea is removed from the document.  Not clearing it led to crashes.</p>
+<textarea id="textarea"></textarea>
+<script>
+if (window.layoutTestController)
+    window.layoutTestController.dumpAsText();
+textarea = document.getElementById("textarea");
+textarea.setSelectionRange(0, 0);
+textarea.parentNode.removeChild(textarea);
+if (window.getSelection().type != "None")
+    alert("FAILURE: There shouldn't be a selection.")
+else
+    alert("SUCCESS: The selection was cleared.")
+</script>

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 38f62a3d640362331888ebc532ef3fbf8ee6e29e..0f8d69f05069d0dc3a241a596858473491ddb0b3 100644 (file)
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,17 @@
+2007-11-15  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/5497643> Crash at Node::isDescendantOf when switching out of Edit HTML Source mode
+        
+        A textarea that contained the selection was removed but the selection wasn't cleared,
+        and we'd crash in code that assumed a valid, in-document selection.
+
+        * editing/SelectionController.cpp:
+        (WebCore::removingNodeRemovesPosition): Clear the selection if the node being removed is the
+        shadowAncestorNode of the node that contains the position, not just if the node being removed
+        contains that shadowAncestorNode.
+
 2007-11-15  Nikolas Zimmermann  <zimmermann@kde.org>
 
         Reviewed by Maciej.

diff --git a/WebCore/editing/SelectionController.cpp b/WebCore/editing/SelectionController.cpp
index 889a2f28148b8e35b2f1400428641dd2683e660a..09f343669394b2eff42efe8fd3f18dd8c2b109e9 100644 (file)
--- a/WebCore/editing/SelectionController.cpp
+++ b/WebCore/editing/SelectionController.cpp
@@ -150,11 +150,14 @@ static bool removingNodeRemovesPosition(Node* node, const Position& position)
     if (!position.node())
         return false;
         
-    if (position.node() == node || position.node()->isDescendantOf(node))
+    if (position.node() == node)
         return true;
     
-    Node* shadowAncestorNode = position.node()->shadowAncestorNode();
-    return shadowAncestorNode && shadowAncestorNode->isDescendantOf(node);
+    if (!node->isElementNode())
+        return false;
+    
+    Element* element = static_cast<Element*>(node);
+    return element->contains(position.node()) || element->contains(position.node()->shadowAncestorNode());
 }
 
 void SelectionController::nodeWillBeRemoved(Node *node)