[SCM] WebKit Debian packaging branch, debian/experimental, updated. upstream/1.3.3-9427-gc2be6fc

Wed Dec 22 12:55:19 UTC 2010

The following commit has been merged in the debian/experimental branch:
commit 7de7443b29f9a6fd35a879fa6e88c075e95d86e5
Author: rniwa at webkit.org <rniwa at webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Wed Sep 1 23:18:52 2010 +0000

    2010-09-01  Ryosuke Niwa  <rniwa at webkit.org>
    
            Reviewed by Dimitri Glazkov.
    
            REGRESSION(r66431): WebCore::Editor::selectionStartCSSPropertyValue crashes if no background color is specified
            https://bugs.webkit.org/show_bug.cgi?id=45068
    
            The crash was caused by the assumption that every node has an ancestor with some background color,
            which was obviously false. Fixed this by adding a null for ancestor.
    
            Test: editing/execCommand/backcolor-crash.html
    
            * editing/Editor.cpp:
            (WebCore::Editor::selectionStartCSSPropertyValue):
    2010-09-01  Ryosuke Niwa  <rniwa at webkit.org>
    
            Reviewed by Dimitri Glazkov.
    
            REGRESSION(r66431): WebCore::Editor::selectionStartCSSPropertyValue crashes if no background color is specified
            https://bugs.webkit.org/show_bug.cgi?id=45068
    
            Added a test to ensure WebKit doesn't crash when backColor is queried on a node without any ancestors
            with a background color.
    
            * editing/execCommand/backcolor-crash-expected.txt: Added.
            * editing/execCommand/backcolor-crash.html: Added.
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@66624 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 0d28408..edd8d02 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,16 @@
+2010-09-01  Ryosuke Niwa  <rniwa at webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        REGRESSION(r66431): WebCore::Editor::selectionStartCSSPropertyValue crashes if no background color is specified
+        https://bugs.webkit.org/show_bug.cgi?id=45068
+
+        Added a test to ensure WebKit doesn't crash when backColor is queried on a node without any ancestors
+        with a background color.
+
+        * editing/execCommand/backcolor-crash-expected.txt: Added.
+        * editing/execCommand/backcolor-crash.html: Added.
+
 2010-08-31  Jer Noble  <jer.noble at apple.com>
 
         Reviewed by Darin Adler.
diff --git a/LayoutTests/editing/execCommand/backcolor-crash-expected.txt b/LayoutTests/editing/execCommand/backcolor-crash-expected.txt
new file mode 100644
index 0000000..5534417
--- /dev/null
+++ b/LayoutTests/editing/execCommand/backcolor-crash-expected.txt
@@ -0,0 +1,3 @@
+This is a crash test when executing backColor on a node where all of its ancestors have transparent background color. You should see PASS at the end.
+backColor: rgba(0, 0, 0, 0)
+PASS
diff --git a/LayoutTests/editing/execCommand/backcolor-crash.html b/LayoutTests/editing/execCommand/backcolor-crash.html
new file mode 100644
index 0000000..aa2f4d5
--- /dev/null
+++ b/LayoutTests/editing/execCommand/backcolor-crash.html
@@ -0,0 +1,16 @@
+<html>
+<body>
+This is a crash test when executing backColor on a node where all of its ancestors have transparent background color.  You should see PASS at the end.
+<div id="test" contenteditable></div>
+<script>
+
+if (window.layoutTestController)
+    window.layoutTestController.dumpAsText();
+
+window.getSelection().setPosition(test, 0);
+var color = document.queryCommandValue('backColor', false, null);
+
+document.write('backColor: ' + color + '<br>');
+document.write('PASS');
+</script>
+</html>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 23eee59..a0578be 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,18 @@
+2010-09-01  Ryosuke Niwa  <rniwa at webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        REGRESSION(r66431): WebCore::Editor::selectionStartCSSPropertyValue crashes if no background color is specified
+        https://bugs.webkit.org/show_bug.cgi?id=45068
+
+        The crash was caused by the assumption that every node has an ancestor with some background color,
+        which was obviously false. Fixed this by adding a null for ancestor.
+
+        Test: editing/execCommand/backcolor-crash.html
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::selectionStartCSSPropertyValue):
+
 2010-08-31  Jer Noble  <jer.noble at apple.com>
 
         Reviewed by Darin Adler.
diff --git a/WebCore/editing/Editor.cpp b/WebCore/editing/Editor.cpp
index 1d93308..855d23b 100644
--- a/WebCore/editing/Editor.cpp
+++ b/WebCore/editing/Editor.cpp
@@ -956,13 +956,13 @@ String Editor::selectionStartCSSPropertyValue(int propertyID)
     if (propertyID == CSSPropertyBackgroundColor && (m_frame->selection()->isRange() || hasTransparentBackgroundColor(selectionStyle.get()))) {
         RefPtr<Range> range(m_frame->selection()->toNormalizedRange());
         ExceptionCode ec = 0;
-        Node* ancestor = range->commonAncestorContainer(ec);
-        ASSERT(ancestor);
-        do {
+        for (Node* ancestor = range->commonAncestorContainer(ec); ancestor; ancestor = ancestor->parentNode()) {
             selectionStyle = computedStyle(ancestor);
-            ancestor = ancestor->parentNode();
-        } while (hasTransparentBackgroundColor(selectionStyle.get()));
-        value = selectionStyle->getPropertyValue(CSSPropertyBackgroundColor);
+            if (!hasTransparentBackgroundColor(selectionStyle.get())) {
+                value = selectionStyle->getPropertyValue(CSSPropertyBackgroundColor);
+                break;
+            }
+        }
     }
 
     return value;

-- 
WebKit Debian packaging

