Reviewed by John.

        - fixed <rdar://problem/4887416> REGRESSION (SearchField): Assertion failure in HTMLInputElement::setValueFromRenderer when editing via drag and drop (11846)
        http://bugs.webkit.org/show_bug.cgi?id=11846
        
        * editing/ReplaceSelectionCommand.cpp:
        (WebCore::ReplaceSelectionCommand::doApply): Don't insert extra paragraph separators to avoid
        nesting blocks in plaintext mode, since that's not an issue under normal circumstances.
        * html/HTMLInputElement.h:
        * manual-tests/drag-move-in-search-field.html: Added.
        * rendering/RenderTextControl.cpp:
        (WebCore::RenderTextControl::subtreeHasChanged): constrain the value; we'd
        rather truncate it than end up with an illegal value here.



git-svn-id: svn://svn.chromium.org/blink/trunk@18944 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/WebCore/ChangeLog

+2007-01-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by John.
+
+        - fixed <rdar://problem/4887416> REGRESSION (SearchField): Assertion failure in HTMLInputElement::setValueFromRenderer when editing via drag and drop (11846)
+        http://bugs.webkit.org/show_bug.cgi?id=11846
+        
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::doApply): Don't insert extra paragraph separators to avoid
+        nesting blocks in plaintext mode, since that's not an issue under normal circumstances.
+        * html/HTMLInputElement.h:
+        * manual-tests/drag-move-in-search-field.html: Added.
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::subtreeHasChanged): constrain the value; we'd
+        rather truncate it than end up with an illegal value here.
+
 2007-01-18  Simon Hausmann  <hausmann@kde.org>
 
         Reviewed by Zack.

third_party/WebKit/WebCore/editing/ReplaceSelectionCommand.cpp

@@ -458,7 +458,8 @@ void ReplaceSelectionCommand::doApply()
     if (selection.isNone() || !selection.start().node())
         return;
     
-    if (!selection.isContentRichlyEditable())
+    bool selectionIsPlainText = !selection.isContentRichlyEditable();
+    if (selectionIsPlainText)
         m_matchStyle = true;
     
     Element* currentRoot = selection.rootEditableElement();
@@ -481,7 +482,8 @@ void ReplaceSelectionCommand::doApply()
     
     if (selectionStartWasStartOfParagraph && selectionEndWasEndOfParagraph ||
         startBlock == currentRoot ||
-        startBlock && startBlock->renderer() && startBlock->renderer()->isListItem())
+        startBlock && startBlock->renderer() && startBlock->renderer()->isListItem() ||
+        selectionIsPlainText)
         m_preventNesting = false;
     
     Position insertionPos = selection.start();

third_party/WebKit/WebCore/html/HTMLInputElement.h

@@ -177,13 +177,14 @@ public:
     void addSearchResult();
     void onSearch();
 
+    String constrainValue(const String& proposedValue) const;
+
 protected:
     AtomicString m_name;
 
 private:
     void init();
     bool storesValueSeparateFromAttribute() const;
-    String constrainValue(const String& proposedValue) const;
     String constrainValue(const String& proposedValue, int maxLen) const;
     void recheckValue();
 

third_party/WebKit/WebCore/manual-tests/drag-move-in-search-field.html

+<p>Double-click the word "dolor" to select it, then drag the selection to
+between "lorem" and "ipsum". There should be no assertion failure in a
+debug build.</p>
+
+<input id="foo" type="search" value="lorem ipsum dolor">
+<script>
+function test()
+{
+
+}
+</script>

third_party/WebKit/WebCore/rendering/RenderTextControl.cpp

@@ -467,7 +467,7 @@ void RenderTextControl::subtreeHasChanged()
             frame->textDidChangeInTextArea(element);
     } else {
         HTMLInputElement* input = static_cast<HTMLInputElement*>(element);
-        input->setValueFromRenderer(text());
+        input->setValueFromRenderer(input->constrainValue(text()));
         if (m_cancelButton)
             updateCancelButtonVisibility(m_cancelButton->renderer()->style());