[SCM] WebKit Debian packaging branch, webkit-1.2, updated. upstream/1.1.90-6072-g9a69373

Thu Apr 8 01:57:51 UTC 2010

The following commit has been merged in the webkit-1.2 branch:
commit ba3677ea15326523c052caf6729965af2e5d2b75
Author: enrica at apple.com <enrica at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Wed Feb 24 01:53:17 2010 +0000

    REGRESSION: WebKit crashes when deleting images on blogger.com (34957)
    <rdar://problem/7651935>
    https://bugs.webkit.org/show_bug.cgi?id=34957
    
    Reviewed by Simon Fraser.
    
    WebCore:
    
    Fixing a regression introduced with revision 53085. Anchor elements should not be considered
    in editable content when calculating the position in the parent before the node.
    
    Test: editing/execCommand/delete-image-in-anchor.html
    
    * dom/Position.cpp:
    (WebCore::Position::getInlineBoxAndOffset):
    
    LayoutTests:
    
    * editing/execCommand/delete-image-in-anchor-expected.txt: Added.
    * editing/execCommand/delete-image-in-anchor.html: Added.
    
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@55179 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 427cb01..70a1738 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,14 @@
+2010-02-23  Enrica Casucci  <enrica at apple.com>
+
+        Reviewed by Simon Fraser.
+
+        REGRESSION: WebKit crashes when deleting images on blogger.com (34957)
+        <rdar://problem/7651935>
+        https://bugs.webkit.org/show_bug.cgi?id=34957
+
+        * editing/execCommand/delete-image-in-anchor-expected.txt: Added.
+        * editing/execCommand/delete-image-in-anchor.html: Added.
+
 2010-02-23  Tony Chang  <tony at chromium.org>
 
         Reviewed by Eric Seidel.
diff --git a/LayoutTests/editing/execCommand/delete-image-in-anchor-expected.txt b/LayoutTests/editing/execCommand/delete-image-in-anchor-expected.txt
new file mode 100644
index 0000000..092b700
--- /dev/null
+++ b/LayoutTests/editing/execCommand/delete-image-in-anchor-expected.txt
@@ -0,0 +1,4 @@
+
+
+BEFORE: <a href="../resources/abe.png"><img style="display:block; margin:0px auto 10px; text-align:center;width: 60px; height: 60px;" src="../resources/abe.png" border="0"></a> <br>
+AFTER: <div style="text-align: center;"><font class="Apple-style-span" color="#0000EE"><u><br></u></font></div> <br>
diff --git a/LayoutTests/editing/execCommand/delete-image-in-anchor.html b/LayoutTests/editing/execCommand/delete-image-in-anchor.html
new file mode 100644
index 0000000..9798712
--- /dev/null
+++ b/LayoutTests/editing/execCommand/delete-image-in-anchor.html
@@ -0,0 +1,21 @@
+<html>
+<body contenteditable="true"><div id="test"><a href="../resources/abe.png"><img style="display:block; margin:0px auto 10px; text-align:center;width: 60px; height: 60px;" src="../resources/abe.png" border="0"></a>
+<br></div>
+<ul id="console"></ul>
+</body>
+<script>
+    log("BEFORE: " + document.getElementById("test").innerHTML);
+    document.body.focus()
+    if (window.layoutTestController) {
+        layoutTestController.dumpAsText();
+        layoutTestController.execCommand("DeleteForward");
+    }
+    log("AFTER: " + document.getElementById("test").innerHTML);
+    function log(str) {
+        var li = document.createElement("li");
+        li.appendChild(document.createTextNode(str));
+        var console = document.getElementById("console");
+        console.appendChild(li);
+    }
+</script>
+</html>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 21daa72..cacc673 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,19 @@
+2010-02-23  Enrica Casucci  <enrica at apple.com>
+
+        Reviewed by Simon Fraser.
+
+        REGRESSION: WebKit crashes when deleting images on blogger.com (34957)
+        <rdar://problem/7651935>
+        https://bugs.webkit.org/show_bug.cgi?id=34957
+
+        Fixing a regression introduced with revision 53085. Anchor elements should not be considered
+        in editable content when calculating the position in the parent before the node.
+        
+        Test: editing/execCommand/delete-image-in-anchor.html
+
+        * dom/Position.cpp:
+        (WebCore::Position::getInlineBoxAndOffset):
+
 2010-02-23  Tony Chang  <tony at chromium.org>
 
         Reviewed by Eric Seidel.
diff --git a/WebCore/dom/Position.cpp b/WebCore/dom/Position.cpp
index c0f6fa3..ef0b3c1 100644
--- a/WebCore/dom/Position.cpp
+++ b/WebCore/dom/Position.cpp
@@ -1018,7 +1018,7 @@ void Position::getInlineBoxAndOffset(EAffinity affinity, TextDirection primaryDi
             inlineBox = toRenderBox(renderer)->inlineBoxWrapper();
             if (!inlineBox || (caretOffset > inlineBox->caretMinOffset() && caretOffset < inlineBox->caretMaxOffset()))
                 return;
-        } else if (node()->isContentEditable()) {
+        } else if (!node()->isLink() && node()->isContentEditable()) {
             Position pos = positionInParentBeforeNode(node()).upstream();
             pos.getInlineBoxAndOffset(DOWNSTREAM, primaryDirection, inlineBox, caretOffset);
             return;

-- 
WebKit Debian packaging

