Summary: | REGRESSION (r20646): editing/execCommand/hilitecolor.html crashes under guardMalloc | ||||||
---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | mitz | ||||
Component: | New Bugs | Assignee: | Nobody <webkit-unassigned> | ||||
Status: | RESOLVED FIXED | ||||||
Severity: | Major | CC: | andrew, hyatt, justin.garcia | ||||
Priority: | P1 | Keywords: | Regression | ||||
Version: | 523.x (Safari 3) | ||||||
Hardware: | Mac | ||||||
OS: | OS X 10.4 | ||||||
Attachments: |
|
Description
mitz
2007-04-11 15:14:58 PDT
This happens because WebCore::InlineTextBox assumes that its textObject() will not change the length of its text. SplitTextNodeContainingElementCommand violates this by calling splitTextNode() which eventually will hit CharacterData::deleteData, chopping some data off the textObject()'s text as it does the split. We need to watch for this change and update the m_len value as appropriate. I think the problem is calling selectionRect() on a renderer that needs layout (and has dirty line boxes). I don't like the idea of requiring setTextWithOffset to clean up dirty boxes. That's what layout is for. Created attachment 14089 [details]
Avoid calling selectionRect and selectionGapRects on dirty renderers
No layout test regressions.
Landed in 20959 |