[SCM] WebKit Debian packaging branch, webkit-1.2, updated. upstream/1.1.90-6072-g9a69373

Thu Apr 8 00:43:33 UTC 2010

The following commit has been merged in the webkit-1.2 branch:
commit 5eb6201eec5e000a95ec379b3e2076f27bb8aa46
Author: eric at webkit.org <eric at webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Sat Dec 19 18:30:40 2009 +0000

    2009-12-19  MORITA Hajime  <morrita at gmail.com>
    
            Reviewed by Darin Adler.
    
            WebCore::Range::surroundContents NULL pointer crash.
    
            https://bugs.webkit.org/show_bug.cgi?id=31684
    
            * fast/dom/Range/31684-expected.txt: Added.
            * fast/dom/Range/31684.html: Added.
            * fast/dom/Range/script-tests/31684.js: Added.
    2009-12-19  MORITA Hajime  <morrita at gmail.com>
    
            Reviewed by Darin Adler.
    
            WebCore::Range::surroundContents NULL pointer crash.
    
            https://bugs.webkit.org/show_bug.cgi?id=31684
    
            Test: fast/dom/Range/31684.html
    
            * dom/Range.cpp:
            (WebCore::Range::surroundContents):
            throw exception when parentOfNewParent->parentNode() is NULL.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@52388 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 6d444ac..916a821 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,15 @@
+2009-12-19  MORITA Hajime  <morrita at gmail.com>
+
+        Reviewed by Darin Adler.
+
+        WebCore::Range::surroundContents NULL pointer crash.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31684
+
+        * fast/dom/Range/31684-expected.txt: Added.
+        * fast/dom/Range/31684.html: Added.
+        * fast/dom/Range/script-tests/31684.js: Added.
+
 2009-12-18  Simon Fraser  <simon.fraser at apple.com>
 
         Reviewed by Darin Adler.
diff --git a/LayoutTests/fast/dom/Range/31684-expected.txt b/LayoutTests/fast/dom/Range/31684-expected.txt
new file mode 100644
index 0000000..2d5c6bc
--- /dev/null
+++ b/LayoutTests/fast/dom/Range/31684-expected.txt
@@ -0,0 +1,10 @@
+This test checks an orphan text node cannot be surrounded by the range. (bug31684)
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS range.surroundContents(element) threw exception Error: HIERARCHY_REQUEST_ERR: DOM Exception 3.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/fast/dom/Range/31684.html b/LayoutTests/fast/dom/Range/31684.html
new file mode 100644
index 0000000..b66acdb
--- /dev/null
+++ b/LayoutTests/fast/dom/Range/31684.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="../../js/resources/js-test-style.css">
+<script src="../../js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script src="script-tests/31684.js"></script>
+<script src="../../js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/LayoutTests/fast/dom/Range/script-tests/31684.js b/LayoutTests/fast/dom/Range/script-tests/31684.js
new file mode 100644
index 0000000..a759410
--- /dev/null
+++ b/LayoutTests/fast/dom/Range/script-tests/31684.js
@@ -0,0 +1,11 @@
+description(
+    "This test checks an orphan text node cannot be surrounded by the range. (bug31684)"
+);
+
+var range = document.createRange();
+var text = document.createTextNode('hello');
+var element = document.createElement("div");
+range.selectNodeContents(text);
+
+shouldThrow("range.surroundContents(element)", '"Error: HIERARCHY_REQUEST_ERR: DOM Exception 3"');
+var successfullyParsed = true;
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index ef3a6e3..5412048 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,17 @@
+2009-12-19  MORITA Hajime  <morrita at gmail.com>
+
+        Reviewed by Darin Adler.
+
+        WebCore::Range::surroundContents NULL pointer crash.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31684
+
+        Test: fast/dom/Range/31684.html
+
+        * dom/Range.cpp:
+        (WebCore::Range::surroundContents):
+        throw exception when parentOfNewParent->parentNode() is NULL.
+
 2009-12-19  Christian Dywan  <christian at twotoasts.de>
 
         Reviewed by Gustavo Noronha Silva.
diff --git a/WebCore/dom/Range.cpp b/WebCore/dom/Range.cpp
index 84a46c2..d7dec2f 100644
--- a/WebCore/dom/Range.cpp
+++ b/WebCore/dom/Range.cpp
@@ -1417,7 +1417,7 @@ void Range::surroundContents(PassRefPtr<Node> passNewParent, ExceptionCode& ec)
     // although this will fail below for another reason).
     if (parentOfNewParent->isCharacterDataNode())
         parentOfNewParent = parentOfNewParent->parentNode();
-    if (!parentOfNewParent->childTypeAllowed(newParent->nodeType())) {
+    if (!parentOfNewParent || !parentOfNewParent->childTypeAllowed(newParent->nodeType())) {
         ec = HIERARCHY_REQUEST_ERR;
         return;
     }

-- 
WebKit Debian packaging

