Skip to content

GitLab

T
tangled
Commit 295df6ef authored by yutak@chromium.org's avatar yutak@chromium.org
Browse files
Options

Fix a crash caused by invalid selection set by Undo command. 

Undo command resets the selection to the previous position, but under some
conditions it may set the selection to a position in a document that is not
controlled by FrameSelection.

If this happens, a subsequent call of FindString command provokes an assertion
in TextIterator, as it does not expect the selection endpoints to be in another
document.

This patch fixes the issue and adds a layout test that reproduces the assertion
failure.

BUG=374904

Review URL: https://codereview.chromium.org/326323003

git-svn-id: svn://svn.chromium.org/blink/trunk@176010 bbb929c8-8fbe-4397-9dbb-9b2b20218538
parent 02ad0983
Hide whitespace changes
Inline Side-by-side
Showing with 48 additions and 1 deletion
third_party/WebKit/LayoutTests/editing/undo/undo-set-selection-crash-expected.txt 0 → 100644
View file @ 295df6ef
Undo command should not make a selection anchored in another document.
On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
PASS Did not crash.
PASS successfullyParsed is true
TEST COMPLETE
third_party/WebKit/LayoutTests/editing/undo/undo-set-selection-crash.html 0 → 100644
View file @ 295df6ef
<!DOCTYPE html>
<html>
<head>
<script src="../../resources/js-test.js"></script>
</head>
<body>
<div id="test-div" contentEditable="true"><select></select></div>
<script>
description('Undo command should not make a selection anchored in another document.');
window.jsTestIsAsync = true;
var div = document.getElementById('test-div');
var selection = window.getSelection();
div.focus();
document.execCommand('SelectAll');
document.execCommand('Indent');
document.execCommand('Outdent');
var anotherDocument = document.implementation.createHTMLDocument('');
anotherDocument.body.appendChild(selection.getRangeAt(0).extractContents());
div.contentEditable = false;
document.execCommand('Undo');
document.execCommand('FindString', false, 'x');
window.setTimeout(function () {
document.body.removeChild(div);
testPassed('Did not crash.');
finishJSTest();
}, 0);
</script>
</body>
</html>
third_party/WebKit/Source/core/editing/Editor.cpp
View file @ 295df6ef
...@@ -721,7 +721,8 @@ void Editor::unappliedEditing(PassRefPtrWillBeRawPtr<EditCommandComposition> cmd ...@@ -721,7 +721,8 @@ void Editor::unappliedEditing(PassRefPtrWillBeRawPtr<EditCommandComposition> cmd
VisibleSelection newSelection(cmd->startingSelection()); VisibleSelection newSelection(cmd->startingSelection());
newSelection.validatePositionsIfNeeded(); newSelection.validatePositionsIfNeeded();
changeSelectionAfterCommand(newSelection, FrameSelection::CloseTyping | FrameSelection::ClearTypingStyle); if (newSelection.start().document() == m_frame.document() && newSelection.end().document() == m_frame.document())
changeSelectionAfterCommand(newSelection, FrameSelection::CloseTyping | FrameSelection::ClearTypingStyle);
m_lastEditCommand = nullptr; m_lastEditCommand = nullptr;
if (UndoStack* undoStack = this->undoStack()) if (UndoStack* undoStack = this->undoStack())
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment