[BlackBerry] Browser crashed when selecting in textarea

[Sean Wang]

DESCRIPTION:
Browser crashed when select text in textarea.

HOW TO REPRODUCE:
1) load a page which contains <textarea> tag.
2) Input a string in it.
3) Insert <enter> in the middle of string to break it to two lines.
4) Touch and hold to select text in the second line.

EXPECTED:
    A word in the second line should be selected.
ACTUAL:
    Browser crashed.

Note: the browser is debug build.


Thread [3] (Suspended : Signal : SIGSEGV:Segmentation fault)    
    WebCore::NoExceptionAssertionChecker::~NoExceptionAssertionChecker()
    WebCore::Range::Range()
    WebCore::Range::create()
    BlackBerry::WebKit::FatFingers::checkForText()
    BlackBerry::WebKit::FatFingers::findIntersectingRegions()
    BlackBerry::WebKit::FatFingers::findBestPoint()
    BlackBerry::WebKit::SelectionHandler::selectAtPoint()
    BlackBerry::WebKit::WebPage::selectAtPoint()
    SelectionHandler::selectAtPoint()
    TouchHandlerWebKitThread::displayContextMenu()
    TouchHandlerWebKitThread::handleTouchHold()
    TouchHandlerWebKitThread::onTouchEvent()
    WebKitThread::invokeOnTouchMoveEvent()
    BlackBerry::Platform::MethodDelegate3<void ()
    BlackBerry::Platform::ExecutableMessage::execute()
    BlackBerry::Platform::MessageClient::executeMessage()
    BlackBerry::Platform::MessageClient::coalesceMessage()
    BlackBerry::Platform::MessageClient::receivePendingMessage()
    BlackBerry::Platform::MessageClient::processNextMessage()
    BlackBerry::Platform::MessageClient::exec()
    WebKitThread::exec()
    BlackBerry::Platform::MessageClient::run()
    pthread_atfork()
    pthread_atfork()

[Sean Wang]

Created attachment 144028 [details]
Patch

[Rob Buis]

(In reply to comment #1)
> Created an attachment (id=144028) [details]
> Patch

Is this reviewed internally? Probably Mike Fenton or somebody who knows this code should do that first.

[Sean Wang]

Created attachment 144694 [details]
Patch

[Antonio Gomes]

Comment on attachment 144694 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=144694&action=review

> Source/WebKit/blackberry/WebKitSupport/FatFingers.cpp:498
> +                         (m_targetType == Text ? DoNotAllowShadowContent : AllowShadowContent));

lets move this x ? y : z out, to an earlier line.

[Sean Wang]

Created attachment 144707 [details]
Patch

Antonio, did you mean like this patch or just move the two lines to a single line?

[WebKit Review Bot]

Comment on attachment 144707 [details]
Patch

Clearing flags on attachment: 144707

Committed r118912: <http://trac.webkit.org/changeset/118912>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.