Diff
Copied: branches/chromium/742/LayoutTests/fast/forms/text-control-selection-crash-expected.txt (from rev 88456, trunk/LayoutTests/fast/forms/text-control-selection-crash-expected.txt) (0 => 88776)
--- branches/chromium/742/LayoutTests/fast/forms/text-control-selection-crash-expected.txt (rev 0)
+++ branches/chromium/742/LayoutTests/fast/forms/text-control-selection-crash-expected.txt 2011-06-14 05:34:52 UTC (rev 88776)
@@ -0,0 +1 @@
+Test passes if it does not crash.
Copied: branches/chromium/742/LayoutTests/fast/forms/text-control-selection-crash.html (from rev 88456, trunk/LayoutTests/fast/forms/text-control-selection-crash.html) (0 => 88776)
--- branches/chromium/742/LayoutTests/fast/forms/text-control-selection-crash.html (rev 0)
+++ branches/chromium/742/LayoutTests/fast/forms/text-control-selection-crash.html 2011-06-14 05:34:52 UTC (rev 88776)
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+Test passes if it does not crash.
+<textarea id="A"></textarea>
+<textarea id="B"></textarea>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+A.selectionStart = 0;
+B.style.display = "none";
+B.selectionStart = 0;
+</script>
+</html>
Modified: branches/chromium/742/Source/WebCore/accessibility/AccessibilityRenderObject.cpp (88775 => 88776)
--- branches/chromium/742/Source/WebCore/accessibility/AccessibilityRenderObject.cpp 2011-06-14 05:25:21 UTC (rev 88775)
+++ branches/chromium/742/Source/WebCore/accessibility/AccessibilityRenderObject.cpp 2011-06-14 05:34:52 UTC (rev 88776)
@@ -2490,7 +2490,7 @@
int AccessibilityRenderObject::indexForVisiblePosition(const VisiblePosition& pos) const
{
if (isNativeTextControl())
- return toRenderTextControl(m_renderer)->indexForVisiblePosition(pos);
+ return RenderTextControl::indexForVisiblePosition(toRenderTextControl(m_renderer)->innerTextElement(), pos);
if (!isTextControl())
return 0;
Modified: branches/chromium/742/Source/WebCore/rendering/RenderTextControl.cpp (88775 => 88776)
--- branches/chromium/742/Source/WebCore/rendering/RenderTextControl.cpp 2011-06-14 05:25:21 UTC (rev 88775)
+++ branches/chromium/742/Source/WebCore/rendering/RenderTextControl.cpp 2011-06-14 05:34:52 UTC (rev 88776)
@@ -205,7 +205,12 @@
Frame* frame = this->frame();
if (!frame)
return 0;
- return indexForVisiblePosition(frame->selection()->start());
+
+ HTMLElement* innerText = innerTextElement();
+ // Do not call innerTextElement() in the function arguments as creating a VisiblePosition
+ // from frame->selection->start() can blow us from underneath. Also, function ordering is
+ // usually dependent on the compiler.
+ return RenderTextControl::indexForVisiblePosition(innerText, frame->selection()->start());
}
int RenderTextControl::selectionEnd() const
@@ -213,7 +218,12 @@
Frame* frame = this->frame();
if (!frame)
return 0;
- return indexForVisiblePosition(frame->selection()->end());
+
+ HTMLElement* innerText = innerTextElement();
+ // Do not call innerTextElement() in the function arguments as creating a VisiblePosition
+ // from frame->selection->end() can blow us from underneath. Also, function ordering is
+ // usually dependent on the compiler.
+ return RenderTextControl::indexForVisiblePosition(innerText, frame->selection()->end());
}
bool RenderTextControl::hasVisibleTextArea() const
@@ -256,15 +266,15 @@
frame->selection()->setSelection(newSelection);
}
-bool RenderTextControl::isSelectableElement(Node* node) const
+bool RenderTextControl::isSelectableElement(HTMLElement* innerText, Node* node)
{
- if (!node || !m_innerText)
+ if (!node || !innerText)
return false;
-
- if (node->rootEditableElement() == m_innerText)
+
+ if (node->rootEditableElement() == innerText)
return true;
- if (!m_innerText->contains(node))
+ if (!innerText->contains(node))
return false;
Node* shadowAncestor = node->shadowAncestorNode();
@@ -334,14 +344,14 @@
return VisiblePosition(Position(endContainer, endOffset, Position::PositionIsOffsetInAnchor), UPSTREAM);
}
-int RenderTextControl::indexForVisiblePosition(const VisiblePosition& pos) const
+int RenderTextControl::indexForVisiblePosition(HTMLElement* innerTextElement, const VisiblePosition& pos)
{
Position indexPosition = pos.deepEquivalent();
- if (!isSelectableElement(indexPosition.deprecatedNode()))
+ if (!RenderTextControl::isSelectableElement(innerTextElement, indexPosition.deprecatedNode()))
return 0;
ExceptionCode ec = 0;
- RefPtr<Range> range = Range::create(document());
- range->setStart(m_innerText.get(), 0, ec);
+ RefPtr<Range> range = Range::create(indexPosition.document());
+ range->setStart(innerTextElement, 0, ec);
ASSERT(!ec);
range->setEnd(indexPosition.deprecatedNode(), indexPosition.deprecatedEditingOffset(), ec);
ASSERT(!ec);
Modified: branches/chromium/742/Source/WebCore/rendering/RenderTextControl.h (88775 => 88776)
--- branches/chromium/742/Source/WebCore/rendering/RenderTextControl.h 2011-06-14 05:25:21 UTC (rev 88775)
+++ branches/chromium/742/Source/WebCore/rendering/RenderTextControl.h 2011-06-14 05:34:52 UTC (rev 88776)
@@ -49,7 +49,7 @@
void selectionChanged(bool userTriggered);
VisiblePosition visiblePositionForIndex(int index) const;
- int indexForVisiblePosition(const VisiblePosition&) const;
+ static int indexForVisiblePosition(HTMLElement*, const VisiblePosition&);
void updatePlaceholderVisibility(bool, bool);
@@ -104,7 +104,7 @@
bool hasVisibleTextArea() const;
friend void setSelectionRange(Node*, int start, int end);
- bool isSelectableElement(Node*) const;
+ static bool isSelectableElement(HTMLElement*, Node*);
virtual int textBlockInsetLeft() const = 0;
virtual int textBlockInsetRight() const = 0;
