Summary: | REGRESSION: Crash occurs when attempting to drag selection into Depart/Return input fields at http://www.travelocity.com/ | ||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Chris Petersen <c.petersen87> | ||||||||||
Component: | HTML Editing | Assignee: | Darin Adler <darin> | ||||||||||
Status: | VERIFIED FIXED | ||||||||||||
Severity: | Normal | CC: | backlink788, justin.garcia | ||||||||||
Priority: | P1 | Keywords: | InRadar, Regression | ||||||||||
Version: | 420+ | ||||||||||||
Hardware: | Mac | ||||||||||||
OS: | OS X 10.4 | ||||||||||||
Attachments: |
|
Description
Chris Petersen
2006-04-10 10:29:27 PDT
Created attachment 7620 [details]
back_trace
This issue has been filed as <rdar://problem/4507874> The cause of this is that the drag is targeted at the text node, and when the text field is emptied the text node is gone. So this has the same type of cause that bug 8111 did. Created attachment 7721 [details]
preliminary patch
Created attachment 7722 [details]
reduction
Created attachment 7738 [details]
patch with detailed change log, manual test
Is replaceChild really an optimization? You could make the SelectionController& returned by dragCaret() non-const, like selection(). Typo in the changelog entry: + So this change along fixes the crash. (In reply to comment #7) > Is replaceChild really an optimization? Only a slight one, I guess. It sends fewer mutation events. > You could make the SelectionController& returned by dragCaret() non-const, like > selection(). That's probably better than what I did. In general, I think we're still mixed up about SelectionController. If it's really a controller, then we should change selections by calling SelectionController functions. And we should not have setSelection or setDragCaret functions that take a SelectionController. > Typo in the changelog entry: > + So this change along fixes the crash. I'll fix that. |