Copied: branches/chromium/782/LayoutTests/editing/undo/replace-text-in-node-preserving-markers-crash-expected.txt (from rev 91308, trunk/LayoutTests/editing/undo/replace-text-in-node-preserving-markers-crash-expected.txt) (0 => 92519)
--- branches/chromium/782/LayoutTests/editing/undo/replace-text-in-node-preserving-markers-crash-expected.txt (rev 0)
+++ branches/chromium/782/LayoutTests/editing/undo/replace-text-in-node-preserving-markers-crash-expected.txt 2011-08-05 22:12:41 UTC (rev 92519)
@@ -0,0 +1,27 @@
+EDITING DELEGATE: shouldBeginEditingInDOMRange:range from 0 of DIV > BODY > HTML > #document to 2 of DIV > BODY > HTML > #document
+EDITING DELEGATE: webViewDidBeginEditing:WebViewDidBeginEditingNotification
+EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
+EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
+EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
+EDITING DELEGATE: shouldDeleteDOMRange:range from 7 of #text > SYMBOL > UL > DIV > BODY > HTML > #document to 8 of #text > SYMBOL > UL > DIV > BODY > HTML > #document
+EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
+EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
+EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
+EDITING DELEGATE: shouldDeleteDOMRange:range from 6 of #text > SYMBOL > UL > DIV > BODY > HTML > #document to 7 of #text > SYMBOL > UL > DIV > BODY > HTML > #document
+EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
+EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
+EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
+EDITING DELEGATE: shouldDeleteDOMRange:range from 5 of #text > SYMBOL > UL > DIV > BODY > HTML > #document to 6 of #text > SYMBOL > UL > DIV > BODY > HTML > #document
+EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
+EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
+EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
+EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
+EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
+EDITING DELEGATE: shouldChangeSelectedDOMRange:range from 4 of #text > SYMBOL > UL > DIV > BODY > HTML > #document to 5 of #text > SYMBOL > UL > DIV > BODY > HTML > #document toDOMRange:range from 5 of #text > SYMBOL > UL > DIV > BODY > HTML > #document to 5 of #text > SYMBOL > UL > DIV > BODY > HTML > #document affinity:NSSelectionAffinityDownstream stillSelecting:FALSE
+EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
+EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
+EDITING DELEGATE: shouldDeleteDOMRange:range from 4 of #text > SYMBOL > UL > DIV > BODY > HTML > #document to 5 of #text > SYMBOL > UL > DIV > BODY > HTML > #document
+EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
+EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
+EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
+PASSEDabcdhijkl
Copied: branches/chromium/782/LayoutTests/editing/undo/replace-text-in-node-preserving-markers-crash.html (from rev 91308, trunk/LayoutTests/editing/undo/replace-text-in-node-preserving-markers-crash.html) (0 => 92519)
--- branches/chromium/782/LayoutTests/editing/undo/replace-text-in-node-preserving-markers-crash.html (rev 0)
+++ branches/chromium/782/LayoutTests/editing/undo/replace-text-in-node-preserving-markers-crash.html 2011-08-05 22:12:41 UTC (rev 92519)
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<style>
+.editing { width: 12px; }
+</style>
+<script src=""
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+function editingTest() {
+ moveSelectionForwardByWordCommand();
+ moveSelectionForwardByWordCommand();
+ deleteCommand();
+ deleteCommand();
+ deleteCommand();
+ deleteCommand();
+}
+</script>
+<div contenteditable class="editing">
+<ul>PASSED<symbol id="test">abcd efg hijkl
+<script>
+runEditingTest();
+</script>
+</html>
Modified: branches/chromium/782/Source/WebCore/editing/CompositeEditCommand.cpp (92518 => 92519)
--- branches/chromium/782/Source/WebCore/editing/CompositeEditCommand.cpp 2011-08-05 22:08:24 UTC (rev 92518)
+++ branches/chromium/782/Source/WebCore/editing/CompositeEditCommand.cpp 2011-08-05 22:12:41 UTC (rev 92519)
@@ -338,18 +338,27 @@
applyCommandToComposite(InsertIntoTextNodeCommand::create(node, offset, replacementText));
}
+static void copyMarkers(const Vector<DocumentMarker*>& markerPointers, Vector<DocumentMarker>& markers)
+{
+ size_t arraySize = markerPointers.size();
+ markers.reserveCapacity(arraySize);
+ for (size_t i = 0; i < arraySize; ++i)
+ markers.append(*markerPointers[i]);
+}
+
void CompositeEditCommand::replaceTextInNodePreservingMarkers(PassRefPtr<Text> prpNode, unsigned offset, unsigned count, const String& replacementText)
{
RefPtr<Text> node(prpNode);
DocumentMarkerController* markerController = document()->markers();
- Vector<DocumentMarker*> markers = markerController->markersInRange(Range::create(document(), node, offset, node, offset + count).get(), DocumentMarker::AllMarkers());
+ Vector<DocumentMarker> markers;
+ copyMarkers(markerController->markersInRange(Range::create(document(), node, offset, node, offset + count).get(), DocumentMarker::AllMarkers()), markers);
replaceTextInNode(node, offset, count, replacementText);
RefPtr<Range> newRange = Range::create(document(), node, offset, node, offset + replacementText.length());
for (size_t i = 0; i < markers.size(); ++i) {
- if (markers[i]->hasDescription())
- markerController->addMarker(newRange.get(), markers[i]->type(), markers[i]->description());
+ if (markers[i].hasDescription())
+ markerController->addMarker(newRange.get(), markers[i].type(), markers[i].description());
else
- markerController->addMarker(newRange.get(), markers[i]->type());
+ markerController->addMarker(newRange.get(), markers[i].type());
}
}
