Attachment 148181 Details for Bug 88502 – Patch

[patch] Patch

bug-88502-20120619070443.patch (text/plain), 6.71 KB, created by Shinya Kawanaka on 2012-06-18 15:04:44 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Shinya Kawanaka

Created: 2012-06-18 15:04:44 PDT

Size: 6.71 KB

patch

obsolete

>Subversion Revision: 120603
>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index f034f9e5c4d62367c008f31386b90ed791995493..1919749322a6b7243567940cdeba09de4ad5a022 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,28 @@
>+2012-06-18  Shinya Kawanaka  <shinyak@chromium.org>
>+
>+        [Shadow][Editing] applying document.execCommand('bold') twice to elements having shadow insertion points causes a crash.
>+        https://bugs.webkit.org/show_bug.cgi?id=88502
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        When inserting or removing insertion points (<shadow> or <content>) into or from Shdaow DOM, shadow content
>+        distribution is invalidated. It will remove all renderers in the same Shadow DOM. When it happends in editing,
>+        a content-editable elements may be considered as non-content-editable element. This triggers ASSERT failure, since
>+        it's like editing non-content-editable element.
>+
>+        To prevent it, content-editablility should be recalculated if necessary. This will be achieved by using
>+        Node::isContentEditable() instead of Node::rendererIsEditable().
>+
>+        Test: editing/shadow/bold-twice-in-shadow.html
>+
>+        * editing/ApplyStyleCommand.cpp:
>+        (WebCore::ApplyStyleCommand::removeInlineStyleFromElement):
>+        * editing/InsertNodeBeforeCommand.cpp:
>+        (WebCore::InsertNodeBeforeCommand::doApply):
>+        (WebCore::InsertNodeBeforeCommand::doUnapply):
>+        * editing/RemoveNodeCommand.cpp:
>+        (WebCore::RemoveNodeCommand::doApply):
>+
> 2012-06-18  Takashi Sakamoto  <tasak@google.com>
> 
>         webkit fails IETC border-radius-clip-002
>diff --git a/Source/WebCore/editing/ApplyStyleCommand.cpp b/Source/WebCore/editing/ApplyStyleCommand.cpp
>index 968f44d87d950d8f88b82433dc36a7fe58b291cc..7787e6496f8f7a1cafbe6edd9eebe9268fad752d 100644
>--- a/Source/WebCore/editing/ApplyStyleCommand.cpp
>+++ b/Source/WebCore/editing/ApplyStyleCommand.cpp
>@@ -821,7 +821,7 @@ bool ApplyStyleCommand::removeInlineStyleFromElement(EditingStyle* style, PassRe
> {
>     ASSERT(element);
> 
>-    if (!element->parentNode() || !element->parentNode()->rendererIsEditable())
>+    if (!element->parentNode() || !element->parentNode()->isContentEditable())
>         return false;
> 
>     if (isStyledInlineElementToRemove(element.get())) {
>diff --git a/Source/WebCore/editing/InsertNodeBeforeCommand.cpp b/Source/WebCore/editing/InsertNodeBeforeCommand.cpp
>index 5b985b54790af6a8cc9e6b2b9a317d84fd5aad11..93213cc238d9044dcf0ac160f11bac763d7728dc 100644
>--- a/Source/WebCore/editing/InsertNodeBeforeCommand.cpp
>+++ b/Source/WebCore/editing/InsertNodeBeforeCommand.cpp
>@@ -48,7 +48,7 @@ InsertNodeBeforeCommand::InsertNodeBeforeCommand(PassRefPtr<Node> insertChild, P
> void InsertNodeBeforeCommand::doApply()
> {
>     ContainerNode* parent = m_refChild->parentNode();
>-    if (!parent || !parent->rendererIsEditable())
>+    if (!parent || !parent->isContentEditable())
>         return;
> 
>     ExceptionCode ec;
>@@ -60,7 +60,7 @@ void InsertNodeBeforeCommand::doApply()
> 
> void InsertNodeBeforeCommand::doUnapply()
> {
>-    if (!m_insertChild->rendererIsEditable())
>+    if (!m_insertChild->isContentEditable())
>         return;
>         
>     // Need to notify this before actually deleting the text
>diff --git a/Source/WebCore/editing/RemoveNodeCommand.cpp b/Source/WebCore/editing/RemoveNodeCommand.cpp
>index 18c5cd2f71c3fdb48d5460ad7ff888199c826aba..19657ac0fc7721223583574bc6bd2081d3dc7696 100644
>--- a/Source/WebCore/editing/RemoveNodeCommand.cpp
>+++ b/Source/WebCore/editing/RemoveNodeCommand.cpp
>@@ -42,7 +42,7 @@ RemoveNodeCommand::RemoveNodeCommand(PassRefPtr<Node> node)
> void RemoveNodeCommand::doApply()
> {
>     ContainerNode* parent = m_node->parentNode();
>-    if (!parent || !parent->rendererIsEditable())
>+    if (!parent || !parent->isContentEditable())
>         return;
> 
>     m_parent = parent;
>diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
>index 0b825d78e05e5ded1cf925ede8e402c65eae41ba..eba69d0de2111f575e8c76d05d737737ed0bdd15 100644
>--- a/LayoutTests/ChangeLog
>+++ b/LayoutTests/ChangeLog
>@@ -1,3 +1,13 @@
>+2012-06-18  Shinya Kawanaka  <shinyak@chromium.org>
>+
>+        [Shadow][Editing] applying document.execCommand('bold') twice to elements having shadow insertion points causes a crash.
>+        https://bugs.webkit.org/show_bug.cgi?id=88502
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * editing/shadow/bold-twice-in-shadow-expected.txt: Added.
>+        * editing/shadow/bold-twice-in-shadow.html: Added.
>+
> 2012-06-18  Takashi Sakamoto  <tasak@google.com>
> 
>         webkit fails IETC border-radius-clip-002
>diff --git a/LayoutTests/editing/shadow/bold-twice-in-shadow-expected.txt b/LayoutTests/editing/shadow/bold-twice-in-shadow-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..e4ef18d8b767be535f70da938ab57a85bb684072
>--- /dev/null
>+++ b/LayoutTests/editing/shadow/bold-twice-in-shadow-expected.txt
>@@ -0,0 +1,8 @@
>+before host
>+ not editable
>+after host
>+PASS document.execCommand("Bold") did not cause a crash.
>+PASS successfullyParsed is true
>+
>+TEST COMPLETE
>+
>diff --git a/LayoutTests/editing/shadow/bold-twice-in-shadow.html b/LayoutTests/editing/shadow/bold-twice-in-shadow.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..e7af2358ffedc096b3f856f2a60917e0e84a1080
>--- /dev/null
>+++ b/LayoutTests/editing/shadow/bold-twice-in-shadow.html
>@@ -0,0 +1,39 @@
>+<!DOCTYPE html>
>+<html>
>+<body>
>+<script src="../../fast/dom/shadow/resources/polyfill.js"></script>
>+<script src="../../fast/dom/resources/event-sender-util.js"></script>
>+<script src="../../fast/js/resources/js-test-pre.js"></script>
>+
>+<div contenteditable>
>+    before host
>+    <div id="host">    <span contenteditable="false">not editable<span></div>
>+    after host
>+</div>
>+<pre id="console"></pre>
>+
>+<script>
>+var shadowRoot = new WebKitShadowRoot(host);
>+shadowRoot.innerHTML = '<div id="shadow-host"><span contenteditable>shadow before</span><shadow></shadow>shadow (after)</div>';
>+
>+var nestedShadowHost = shadowRoot.getElementById('shadow-host');
>+var nestedShadowRoot = new WebKitShadowRoot(nestedShadowHost);
>+nestedShadowRoot.innerHTML = '<div id="inner" contenteditable>nested before<shadow></shadow>nested after</div>';
>+
>+var div = nestedShadowRoot.getElementById('inner');
>+
>+eventSender.mouseMoveTo(div.offsetLeft + 5, div.offsetTop + div.offsetHeight / 2);
>+eventSender.mouseDown();
>+eventSender.mouseMoveTo(div.offsetLeft + div.offsetWidth - 5, div.offsetTop + div.offsetHeight / 2);
>+eventSender.mouseUp();
>+
>+document.execCommand('Bold');
>+document.execCommand('Bold');
>+debug('PASS document.execCommand("Bold") did not cause a crash.');
>+
>+var successfullyParsed = true;
>+</script>
>+
>+<script src="../../fast/js/resources/js-test-post.js"></script>
>+</body>
>+</html>

Actions: View | Formatted Diff | Diff

Attachments on bug 88502: 147009 | 148181 | 148365