Merge r181773 - Source/WebCore:

REGRESSION (r109593): Clicking after last inline element could cause a crash. https://bugs.webkit.org/show_bug.cgi?id=142880 rdar://problem/17222294 Reviewed by Ryosuke Niwa. Test: editing/selection/click-after-last-inline-crash.html * rendering/RootInlineBox.cpp: (WebCore::RootInlineBox::closestLeafChildForLogicalLeftPosition): Canonical link: https://commits.webkit.org/154760.333@webkitgtk/2.6 git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@182420 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WebKit · Apr 6, 2015 · d1c706e · d1c706e
1 parent cf6e27e
commit d1c706e
Show file tree

Hide file tree

Showing 5 changed files with 56 additions and 2 deletions.
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
@@ -1,3 +1,14 @@
+2015-03-19  Enrica Casucci  <enrica@apple.com>
+
+        REGRESSION (r109593): Clicking after last inline element could cause a crash.
+        https://bugs.webkit.org/show_bug.cgi?id=142880
+        rdar://problem/17222294
+
+        Reviewed by Ryosuke Niwa.
+
+        * editing/selection/click-after-last-inline-crash-expected.txt: Added.
+        * editing/selection/click-after-last-inline-crash.html: Added.
+
 2015-03-18  Manuel Rego Casasnovas  <rego@igalia.com>
 
         Flex and grid items should be painted as inline-blocks

diff --git a/LayoutTests/editing/selection/click-after-last-inline-crash-expected.txt b/LayoutTests/editing/selection/click-after-last-inline-crash-expected.txt
@@ -0,0 +1,7 @@
+Click after the end of the line with link.
+
+This is a link
+
+It should NOT crash!
+
+PASS
diff --git a/LayoutTests/editing/selection/click-after-last-inline-crash.html b/LayoutTests/editing/selection/click-after-last-inline-crash.html
@@ -0,0 +1,23 @@
+<html>
+<body>
+<div style="border: solid red 2px;">
+Click after the end of the line with link.<br><br><a id='test' href="http://aftershock.su/?q=node/259078">This is a link</a><wbr><br><br>It should NOT crash!<br><br>
+</div>
+</body>
+<script>
+if (window.testRunner) {
+    testRunner.dumpAsText();
+
+    if (!window.eventSender)
+        document.writeln('This test requires eventSender');
+    else {
+        var testElement = document.getElementById('test');
+        eventSender.mouseMoveTo(testElement.offsetLeft + testElement.offsetWidth + 50, testElement.offsetTop + 5);
+        eventSender.mouseDown();
+        eventSender.mouseUp();
+        document.writeln('PASS');
+    }
+}
+
+</script>
+</html>
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
@@ -1,3 +1,16 @@
+2015-03-19  Enrica Casucci  <enrica@apple.com>
+
+        REGRESSION (r109593): Clicking after last inline element could cause a crash.
+        https://bugs.webkit.org/show_bug.cgi?id=142880
+        rdar://problem/17222294
+
+        Reviewed by Ryosuke Niwa.
+
+        Test: editing/selection/click-after-last-inline-crash.html
+
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::closestLeafChildForLogicalLeftPosition):
+
 2015-03-18  Manuel Rego Casasnovas  <rego@igalia.com>
 
         Flex and grid items should be painted as inline-blocks

diff --git a/Source/WebCore/rendering/RootInlineBox.cpp b/Source/WebCore/rendering/RootInlineBox.cpp
@@ -707,12 +707,12 @@ InlineBox* RootInlineBox::closestLeafChildForLogicalLeftPosition(int leftPositio
         return firstLeaf;
 
     // Avoid returning a list marker when possible.
-    if (leftPosition <= firstLeaf->logicalLeft() && !firstLeaf->renderer().isListMarker() && (!onlyEditableLeaves || isEditableLeaf(firstLeaf)))
+    if (firstLeaf && leftPosition <= firstLeaf->logicalLeft() && !firstLeaf->renderer().isListMarker() && (!onlyEditableLeaves || isEditableLeaf(firstLeaf)))
         // The leftPosition coordinate is less or equal to left edge of the firstLeaf.
         // Return it.
         return firstLeaf;
 
-    if (leftPosition >= lastLeaf->logicalRight() && !lastLeaf->renderer().isListMarker() && (!onlyEditableLeaves || isEditableLeaf(lastLeaf)))
+    if (lastLeaf && leftPosition >= lastLeaf->logicalRight() && !lastLeaf->renderer().isListMarker() && (!onlyEditableLeaves || isEditableLeaf(lastLeaf)))
         // The leftPosition coordinate is greater or equal to right edge of the lastLeaf.
         // Return it.
         return lastLeaf;