2010-05-31 Tony Chang <tony@chromium.org>

Reviewed by Dan Bernstein. REGRESSION (r58665): Infinite recursion in Position::getInlineBoxAndOffset() https://bugs.webkit.org/show_bug.cgi?id=39946 * editing/selection/mixed-editability-12-expected.txt: Added. * editing/selection/mixed-editability-12.html: Added. 2010-05-31 Tony Chang <tony@chromium.org> Reviewed by Dan Bernstein. REGRESSION (r58665): Infinite recursion in Position::getInlineBoxAndOffset() https://bugs.webkit.org/show_bug.cgi?id=39946 r58665 added an infinite recursion check, but didn't take into consideration recursion between two Positions. This adds a check for when downstreamIgnoringEditingBoundaries(p1) == p2 and upstreamIgnoringEditingBoundaries(p2) == p1 Test: editing/selection/mixed-editability-12.html * dom/Position.cpp: (WebCore::Position::getInlineBoxAndOffset): git-svn-id: svn://svn.chromium.org/blink/trunk@60459 bbb929c8-8fbe-4397-9dbb-9b2b20218538

2010-05-31 Tony Chang <tony@chromium.org>
Reviewed by Dan Bernstein. REGRESSION (r58665): Infinite recursion in Position::getInlineBoxAndOffset() https://bugs.webkit.org/show_bug.cgi?id=39946 * editing/selection/mixed-editability-12-expected.txt: Added. * editing/selection/mixed-editability-12.html: Added. 2010-05-31 Tony Chang <tony@chromium.org> Reviewed by Dan Bernstein. REGRESSION (r58665): Infinite recursion in Position::getInlineBoxAndOffset() https://bugs.webkit.org/show_bug.cgi?id=39946 r58665 added an infinite recursion check, but didn't take into consideration recursion between two Positions. This adds a check for when downstreamIgnoringEditingBoundaries(p1) == p2 and upstreamIgnoringEditingBoundaries(p2) == p1 Test: editing/selection/mixed-editability-12.html * dom/Position.cpp: (WebCore::Position::getInlineBoxAndOffset): git-svn-id: svn://svn.chromium.org/blink/trunk@60459 bbb929c8-8fbe-4397-9dbb-9b2b20218538
664b6437 · tony@chromium.org · bd0d8071 · 664b6437 · 664b6437 · 664b6437
Commit 664b6437 authored Jun 01, 2010 by tony@chromium.org
5 changed files
--- a/third_party/WebKit/LayoutTests/ChangeLog
+++ b/third_party/WebKit/LayoutTests/ChangeLog
+2010-05-31  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION (r58665): Infinite recursion in Position::getInlineBoxAndOffset()
+        https://bugs.webkit.org/show_bug.cgi?id=39946
+
+        * editing/selection/mixed-editability-12-expected.txt: Added.
+        * editing/selection/mixed-editability-12.html: Added.
+
 2010-05-31  Leo Yang  <leo.yang@torchmobile.com.cn>

        Reviewed by George Staikos.

--- a/third_party/WebKit/LayoutTests/editing/selection/mixed-editability-12-expected.txt
+++ b/third_party/WebKit/LayoutTests/editing/selection/mixed-editability-12-expected.txt
+Test for https://bugs.webkit.org/show_bug.cgi?id=39946 another case of infinite recursion in Position::getInlineBoxAndOffset(). This test passes if it does not crash.
+
+start dragging here and drag right
+spacer text
+
--- a/third_party/WebKit/LayoutTests/editing/selection/mixed-editability-12.html
+++ b/third_party/WebKit/LayoutTests/editing/selection/mixed-editability-12.html
+<body contenteditable=true>
+<p contenteditable=false>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=39946">https://bugs.webkit.org/show_bug.cgi?id=39946</a>
+another case of infinite recursion in Position::getInlineBoxAndOffset().  This test passes if it does not crash.</p>
+<div id="start">start dragging here and drag right<div>
+<div style="-webkit-user-modify: read-only; display:inline-block;">
+  <div style="display:none;">some text</div>
+  <div style="width: 550px;">
+    spacer text
+  </div>
+</div>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    var selection = getSelection();
+    var start = document.getElementById("start");
+    selection.setBaseAndExtent(start, 1, start, 1);
+    selection.modify("move", "forward", "line");
+    selection.modify("move", "backward", "character");
+</script>
+</body>
--- a/third_party/WebKit/WebCore/ChangeLog
+++ b/third_party/WebKit/WebCore/ChangeLog
+2010-05-31  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION (r58665): Infinite recursion in Position::getInlineBoxAndOffset()
+        https://bugs.webkit.org/show_bug.cgi?id=39946
+        
+        r58665 added an infinite recursion check, but didn't take into consideration recursion between two
+        Positions.  This adds a check for when
+        downstreamIgnoringEditingBoundaries(p1) == p2 and upstreamIgnoringEditingBoundaries(p2) == p1
+
+        Test: editing/selection/mixed-editability-12.html
+
+        * dom/Position.cpp:
+        (WebCore::Position::getInlineBoxAndOffset):
+
 2010-05-31  Leo Yang  <leo.yang@torchmobile.com.cn>

        Reviewed by George Staikos.

--- a/third_party/WebKit/WebCore/dom/Position.cpp
+++ b/third_party/WebKit/WebCore/dom/Position.cpp
@@ -1018,10 +1018,11 @@ void Position::getInlineBoxAndOffset(EAffinity affinity, TextDirection primaryDi
            // an editable block but surrounded by non-editable positions. It acts to negate the logic at the beginning
            // of RenderObject::createVisiblePosition().
            Position equivalent = downstreamIgnoringEditingBoundaries(*this);
-            if (equivalent == *this)
+            if (equivalent == *this) {
                equivalent = upstreamIgnoringEditingBoundaries(*this);
-            if (equivalent == *this)
-                return;
+                if (equivalent == *this || downstreamIgnoringEditingBoundaries(equivalent) == *this)
+                    return;
+            }

            equivalent.getInlineBoxAndOffset(UPSTREAM, primaryDirection, inlineBox, caretOffset);
            return;