From 27621ca63c064d1a1d6af6373c2c9f7018e19861 Mon Sep 17 00:00:00 2001 From: Steve Block Date: Thu, 12 Apr 2012 14:35:55 +0100 Subject: Cherry-pick WebKit change r94511 to fix a LayoutTest crash fast/dom/Range/range-delete-contents-event-fire-crash.html See http://trac.webkit.org/changeset/94511 Bug: 6329028 Change-Id: I00cc0e6520831f20f6177f18f4e86d471003ea58 --- Source/WebCore/dom/Range.cpp | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) (limited to 'Source/WebCore') diff --git a/Source/WebCore/dom/Range.cpp b/Source/WebCore/dom/Range.cpp index 469a94a..268687f 100644 --- a/Source/WebCore/dom/Range.cpp +++ b/Source/WebCore/dom/Range.cpp @@ -51,6 +51,8 @@ using namespace std; static WTF::RefCountedLeakCounter rangeCounter("Range"); #endif +typedef Vector > NodeVector; + inline Range::Range(PassRefPtr ownerDocument) : m_ownerDocument(ownerDocument) , m_start(m_ownerDocument) @@ -662,8 +664,6 @@ static inline unsigned lengthOfContentsInNode(Node* node) PassRefPtr Range::processContents(ActionType action, ExceptionCode& ec) { - typedef Vector > NodeVector; - RefPtr fragment; if (action == EXTRACT_CONTENTS || action == CLONE_CONTENTS) fragment = DocumentFragment::create(m_ownerDocument.get()); @@ -873,9 +873,14 @@ PassRefPtr Range::processAncestorsAndTheirSiblings(ActionType action, Node // FIXME: This assertion may fail if DOM is modified during mutation event // FIXME: Share code with Range::processNodes ASSERT(!firstChildInAncestorToProcess || firstChildInAncestorToProcess->parentNode() == ancestor); - RefPtr next; - for (Node* child = firstChildInAncestorToProcess.get(); child; child = next.get()) { - next = direction == ProcessContentsForward ? child->nextSibling() : child->previousSibling(); + + NodeVector nodes; + for (Node* child = firstChildInAncestorToProcess.get(); child; + child = (direction == ProcessContentsForward) ? child->nextSibling() : child->previousSibling()) + nodes.append(child); + + for (NodeVector::const_iterator it = nodes.begin(); it != nodes.end(); it++) { + Node* child = it->get(); switch (action) { case DELETE_CONTENTS: ancestor->removeChild(child, ec); -- cgit v1.1