diff options
author | Steve Block <steveblock@google.com> | 2012-04-12 14:35:55 +0100 |
---|---|---|
committer | Steve Block <steveblock@google.com> | 2012-04-12 17:43:53 +0100 |
commit | 27621ca63c064d1a1d6af6373c2c9f7018e19861 (patch) | |
tree | f77122da00467cc8240311c13e808c915c892e4a /Source/WebCore | |
parent | 65f5521b69d0cfd5e011e73412b6c69ffcf0a897 (diff) | |
download | external_webkit-27621ca63c064d1a1d6af6373c2c9f7018e19861.zip external_webkit-27621ca63c064d1a1d6af6373c2c9f7018e19861.tar.gz external_webkit-27621ca63c064d1a1d6af6373c2c9f7018e19861.tar.bz2 |
Cherry-pick WebKit change r94511 to fix a LayoutTest crash
fast/dom/Range/range-delete-contents-event-fire-crash.html
See http://trac.webkit.org/changeset/94511
Bug: 6329028
Change-Id: I00cc0e6520831f20f6177f18f4e86d471003ea58
Diffstat (limited to 'Source/WebCore')
-rw-r--r-- | Source/WebCore/dom/Range.cpp | 15 |
1 files changed, 10 insertions, 5 deletions
diff --git a/Source/WebCore/dom/Range.cpp b/Source/WebCore/dom/Range.cpp index 469a94a..268687f 100644 --- a/Source/WebCore/dom/Range.cpp +++ b/Source/WebCore/dom/Range.cpp @@ -51,6 +51,8 @@ using namespace std; static WTF::RefCountedLeakCounter rangeCounter("Range"); #endif +typedef Vector<RefPtr<Node> > NodeVector; + inline Range::Range(PassRefPtr<Document> ownerDocument) : m_ownerDocument(ownerDocument) , m_start(m_ownerDocument) @@ -662,8 +664,6 @@ static inline unsigned lengthOfContentsInNode(Node* node) PassRefPtr<DocumentFragment> Range::processContents(ActionType action, ExceptionCode& ec) { - typedef Vector<RefPtr<Node> > NodeVector; - RefPtr<DocumentFragment> fragment; if (action == EXTRACT_CONTENTS || action == CLONE_CONTENTS) fragment = DocumentFragment::create(m_ownerDocument.get()); @@ -873,9 +873,14 @@ PassRefPtr<Node> Range::processAncestorsAndTheirSiblings(ActionType action, Node // FIXME: This assertion may fail if DOM is modified during mutation event // FIXME: Share code with Range::processNodes ASSERT(!firstChildInAncestorToProcess || firstChildInAncestorToProcess->parentNode() == ancestor); - RefPtr<Node> next; - for (Node* child = firstChildInAncestorToProcess.get(); child; child = next.get()) { - next = direction == ProcessContentsForward ? child->nextSibling() : child->previousSibling(); + + NodeVector nodes; + for (Node* child = firstChildInAncestorToProcess.get(); child; + child = (direction == ProcessContentsForward) ? child->nextSibling() : child->previousSibling()) + nodes.append(child); + + for (NodeVector::const_iterator it = nodes.begin(); it != nodes.end(); it++) { + Node* child = it->get(); switch (action) { case DELETE_CONTENTS: ancestor->removeChild(child, ec); |