Merge r181773 - Source/WebCore:

REGRESSION (r109593): Clicking after last inline element could cause a crash. https://bugs.webkit.org/show_bug.cgi?id=142880 rdar://problem/17222294 Reviewed by Ryosuke Niwa. Test: editing/selection/click-after-last-inline-crash.html * rendering/RootInlineBox.cpp: (WebCore::RootInlineBox::closestLeafChildForLogicalLeftPosition): LayoutTests: Web Inspector: Adopt ES6 Class Syntax for all Model Objects https://bugs.webkit.org/show_bug.cgi?id=142858 Patch by Joseph Pecoraro <pecoraro@apple.com> on 2015-03-19 Reviewed by Timothy Hatcher. * inspector/model/parse-script-syntax-tree.html: This test was calling a constructor without "new". Class syntax enforces "new" and threw an exception.
WebKit · Mar 25, 2015 · 16a4b4d · 16a4b4d
1 parent 1bc7421
commit 16a4b4d
Show file tree

Hide file tree

Showing 5 changed files with 56 additions and 2 deletions.
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
@@ -1,3 +1,14 @@
+2015-03-19  Enrica Casucci  <enrica@apple.com>
+
+        REGRESSION (r109593): Clicking after last inline element could cause a crash.
+        https://bugs.webkit.org/show_bug.cgi?id=142880
+        rdar://problem/17222294
+
+        Reviewed by Ryosuke Niwa.
+
+        * editing/selection/click-after-last-inline-crash-expected.txt: Added.
+        * editing/selection/click-after-last-inline-crash.html: Added.
+
 2015-03-18  Said Abou-Hallawa  <sabouhallawa@apple.com>
 
         Switching between two SVG images with no intrinsic sizes causes them to get the default SVG size instead of the container size.

diff --git a/LayoutTests/editing/selection/click-after-last-inline-crash-expected.txt b/LayoutTests/editing/selection/click-after-last-inline-crash-expected.txt
@@ -0,0 +1,7 @@
+Click after the end of the line with link.
+
+This is a link
+
+It should NOT crash!
+
+PASS
diff --git a/LayoutTests/editing/selection/click-after-last-inline-crash.html b/LayoutTests/editing/selection/click-after-last-inline-crash.html
@@ -0,0 +1,23 @@
+<html>
+<body>
+<div style="border: solid red 2px;">
+Click after the end of the line with link.<br><br><a id='test' href="http://aftershock.su/?q=node/259078">This is a link</a><wbr><br><br>It should NOT crash!<br><br>
+</div>
+</body>
+<script>
+if (window.testRunner) {
+    testRunner.dumpAsText();
+
+    if (!window.eventSender)
+        document.writeln('This test requires eventSender');
+    else {
+        var testElement = document.getElementById('test');
+        eventSender.mouseMoveTo(testElement.offsetLeft + testElement.offsetWidth + 50, testElement.offsetTop + 5);
+        eventSender.mouseDown();
+        eventSender.mouseUp();
+        document.writeln('PASS');
+    }
+}
+
+</script>
+</html>
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
@@ -1,3 +1,16 @@
+2015-03-19  Enrica Casucci  <enrica@apple.com>
+
+        REGRESSION (r109593): Clicking after last inline element could cause a crash.
+        https://bugs.webkit.org/show_bug.cgi?id=142880
+        rdar://problem/17222294
+
+        Reviewed by Ryosuke Niwa.
+
+        Test: editing/selection/click-after-last-inline-crash.html
+
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::closestLeafChildForLogicalLeftPosition):
+
 2015-03-18  Manuel Rego Casasnovas  <rego@igalia.com>
 
         Unreviewed. GTK build fix after r181720.

diff --git a/Source/WebCore/rendering/RootInlineBox.cpp b/Source/WebCore/rendering/RootInlineBox.cpp
@@ -763,12 +763,12 @@ InlineBox* RootInlineBox::closestLeafChildForLogicalLeftPosition(int leftPositio
         return firstLeaf;
 
     // Avoid returning a list marker when possible.
-    if (leftPosition <= firstLeaf->logicalLeft() && !firstLeaf->renderer().isListMarker() && (!onlyEditableLeaves || isEditableLeaf(firstLeaf)))
+    if (firstLeaf && leftPosition <= firstLeaf->logicalLeft() && !firstLeaf->renderer().isListMarker() && (!onlyEditableLeaves || isEditableLeaf(firstLeaf)))
         // The leftPosition coordinate is less or equal to left edge of the firstLeaf.
         // Return it.
         return firstLeaf;
 
-    if (leftPosition >= lastLeaf->logicalRight() && !lastLeaf->renderer().isListMarker() && (!onlyEditableLeaves || isEditableLeaf(lastLeaf)))
+    if (lastLeaf && leftPosition >= lastLeaf->logicalRight() && !lastLeaf->renderer().isListMarker() && (!onlyEditableLeaves || isEditableLeaf(lastLeaf)))
         // The leftPosition coordinate is greater or equal to right edge of the lastLeaf.
         // Return it.
         return lastLeaf;