[SCM] WebKit Debian packaging branch, debian/experimental, updated. upstream/1.3.3-9427-gc2be6fc
rniwa at webkit.org
rniwa at webkit.org
Wed Dec 22 13:23:51 UTC 2010
The following commit has been merged in the debian/experimental branch:
commit 435caa063ae2f17e57f6b229007eb64368570fdb
Author: rniwa at webkit.org <rniwa at webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Tue Sep 14 04:18:26 2010 +0000
2010-09-13 Ryosuke Niwa <rniwa at webkit.org>
Reviewed by Darin Adler.
REGRESSION: In Gmail, a crash occurs at getDoubleValue() when applying a text color to a new line
https://bugs.webkit.org/show_bug.cgi?id=45632
Test: editing/execCommand/query-font-size-with-typing-style.html
The crash was caused by selectionStartCSSPropertyValue's deleting nodeToRemove before
retrieving the font-size property. Fixed the bug by moving the removal code to the end of the function.
* editing/Editor.cpp:
(WebCore::Editor::selectionStartCSSPropertyValue):
2010-09-13 Ryosuke Niwa <rniwa at webkit.org>
Reviewed by Darin Adler.
REGRESSION: In Gmail, a crash occurs at getDoubleValue() when applying a text color to a new line
https://bugs.webkit.org/show_bug.cgi?id=45632
Added a test to ensure WebKit does not crash when querying font size even if there is a typing style.
* editing/execCommand/query-font-size-with-typing-style-expected.txt: Added.
* editing/execCommand/query-font-size-with-typing-style.html: Added.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@67441 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 66c1e54..8cc2f12 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,15 @@
+2010-09-13 Ryosuke Niwa <rniwa at webkit.org>
+
+ Reviewed by Darin Adler.
+
+ REGRESSION: In Gmail, a crash occurs at getDoubleValue() when applying a text color to a new line
+ https://bugs.webkit.org/show_bug.cgi?id=45632
+
+ Added a test to ensure WebKit does not crash when querying font size even if there is a typing style.
+
+ * editing/execCommand/query-font-size-with-typing-style-expected.txt: Added.
+ * editing/execCommand/query-font-size-with-typing-style.html: Added.
+
2010-09-13 Eric Carlson <eric.carlson at apple.com>
Reviewed by Geoff Garen.
diff --git a/LayoutTests/editing/execCommand/query-font-size-with-typing-style-expected.txt b/LayoutTests/editing/execCommand/query-font-size-with-typing-style-expected.txt
new file mode 100644
index 0000000..b563bd8
--- /dev/null
+++ b/LayoutTests/editing/execCommand/query-font-size-with-typing-style-expected.txt
@@ -0,0 +1,3 @@
+This tests querying font size when there is a typing style. WebKit should not crash and you should see 'PASS':
+
+PASS
diff --git a/LayoutTests/editing/execCommand/query-font-size-with-typing-style.html b/LayoutTests/editing/execCommand/query-font-size-with-typing-style.html
new file mode 100644
index 0000000..3f3ffc2
--- /dev/null
+++ b/LayoutTests/editing/execCommand/query-font-size-with-typing-style.html
@@ -0,0 +1,17 @@
+<html>
+<body>
+<p>This tests querying font size when there is a typing style. WebKit should not crash and you should see 'PASS':</p>
+<span id="test" contenteditable><br></span>
+<script type="text/javascript">
+
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+window.getSelection().setPosition(document.getElementById('test').firstChild, 0);
+document.execCommand('bold', false, null);
+document.queryCommandValue('fontSize');
+document.getElementById('test').innerHTML = 'PASS';
+
+</script>
+</body>
+</html>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 25cdfc7..227b7c8 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,18 @@
+2010-09-13 Ryosuke Niwa <rniwa at webkit.org>
+
+ Reviewed by Darin Adler.
+
+ REGRESSION: In Gmail, a crash occurs at getDoubleValue() when applying a text color to a new line
+ https://bugs.webkit.org/show_bug.cgi?id=45632
+
+ Test: editing/execCommand/query-font-size-with-typing-style.html
+
+ The crash was caused by selectionStartCSSPropertyValue's deleting nodeToRemove before
+ retrieving the font-size property. Fixed the bug by moving the removal code to the end of the function.
+
+ * editing/Editor.cpp:
+ (WebCore::Editor::selectionStartCSSPropertyValue):
+
2010-09-13 Kwang Yul Seo <skyul at company100.net>
Reviewed by Darin Adler.
diff --git a/WebCore/editing/Editor.cpp b/WebCore/editing/Editor.cpp
index c8f8d8b..3f9a5a5 100644
--- a/WebCore/editing/Editor.cpp
+++ b/WebCore/editing/Editor.cpp
@@ -951,12 +951,6 @@ String Editor::selectionStartCSSPropertyValue(int propertyID)
String value = selectionStyle->getPropertyValue(propertyID);
- if (nodeToRemove) {
- ExceptionCode ec = 0;
- nodeToRemove->remove(ec);
- ASSERT(!ec);
- }
-
// If background color is transparent, traverse parent nodes until we hit a different value or document root
// Also, if the selection is a range, ignore the background color at the start of selection,
// and find the background color of the common ancestor.
@@ -973,11 +967,17 @@ String Editor::selectionStartCSSPropertyValue(int propertyID)
}
if (propertyID == CSSPropertyFontSize) {
- RefPtr<CSSValue> value = selectionStyle->getPropertyCSSValue(CSSPropertyFontSize);
- ASSERT(value->isPrimitiveValue());
- int fontPixelSize = static_cast<CSSPrimitiveValue*>(value.get())->getIntValue(CSSPrimitiveValue::CSS_PX);
+ RefPtr<CSSValue> cssValue = selectionStyle->getPropertyCSSValue(CSSPropertyFontSize);
+ ASSERT(cssValue->isPrimitiveValue());
+ int fontPixelSize = static_cast<CSSPrimitiveValue*>(cssValue.get())->getIntValue(CSSPrimitiveValue::CSS_PX);
int size = CSSStyleSelector::legacyFontSize(m_frame->document(), fontPixelSize, selectionStyle->useFixedFontDefaultSize());
- return String::number(size);
+ value = String::number(size);
+ }
+
+ if (nodeToRemove) {
+ ExceptionCode ec = 0;
+ nodeToRemove->remove(ec);
+ ASSERT(!ec);
}
return value;
--
WebKit Debian packaging
More information about the Pkg-webkit-commits
mailing list