[SCM] WebKit Debian packaging branch, webkit-1.2, updated. upstream/1.1.90-6072-g9a69373

Thu Apr 8 01:15:19 UTC 2010

The following commit has been merged in the webkit-1.2 branch:
commit f00711c2a7906524974a847a6159b2e94f03e055
Author: enrica at apple.com <enrica at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Tue Jan 19 22:17:32 2010 +0000

    WebCore: REGRESSION: Infinite recursion in Position::getInlineBoxAndOffset()
    https://bugs.webkit.org/show_bug.cgi?id=33864
    <rdar://problem/7552959>
    
    Reviewed by Simon Fraser.
    
    Regression has been introduced by changeset 53085.
    The original fix had to be limited to editable content.
    
    Test: editing/selection/selection-applet.html
    
    * dom/Position.cpp:
    (WebCore::Position::getInlineBoxAndOffset):
    
    LayoutTests: REGRESSION: Infinite recursion in Position::getInlineBoxAndOffset()
    https://bugs.webkit.org/show_bug.cgi?id=33864
    <rdar://problem/7552959>
    
    Reviewed by Simon Fraser.
    
    * editing/selection/selection-applet-expected.txt: Added.
    * editing/selection/selection-applet.html: Added.
    
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@53494 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 616f3e9..47304a8 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,14 @@
+2010-01-19  Enrica Casucci  <enrica at apple.com>
+
+        Reviewed by Simon Fraser.
+
+        REGRESSION: Infinite recursion in Position::getInlineBoxAndOffset()
+        https://bugs.webkit.org/show_bug.cgi?id=33864
+        <rdar://problem/7552959>
+
+        * editing/selection/selection-applet-expected.txt: Added.
+        * editing/selection/selection-applet.html: Added.
+
 2010-01-15  Ojan Vafai  <ojan at chromium.org>
 
         Reviewed by Adam Barth.
diff --git a/LayoutTests/editing/selection/selection-applet-expected.txt b/LayoutTests/editing/selection/selection-applet-expected.txt
new file mode 100644
index 0000000..1423912
--- /dev/null
+++ b/LayoutTests/editing/selection/selection-applet-expected.txt
@@ -0,0 +1 @@
+You need Java(tm) to view this presentation. Download Java
diff --git a/LayoutTests/editing/selection/selection-applet.html b/LayoutTests/editing/selection/selection-applet.html
new file mode 100644
index 0000000..2d40584
--- /dev/null
+++ b/LayoutTests/editing/selection/selection-applet.html
@@ -0,0 +1,10 @@
+<body>
+<script language="JavaScript" type="text/javascript">
+if (window.layoutTestController)
+     layoutTestController.dumpAsText();
+
+document.write('<applet id="test" width="400" height="400" name="test applet" code="test.class" codebase="." mayscript>');
+document.write('You need Java(tm) to view this presentation. <a href="http://www.java.com">Download Java</a></applet> ');
+window.getSelection().setPosition(document.getElementById("test"), 0);
+</script>
+</body>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index e59a3d4..08ce7b6 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,19 @@
+2010-01-19  Enrica Casucci  <enrica at apple.com>
+
+        Reviewed by Simon Fraser.
+
+        REGRESSION: Infinite recursion in Position::getInlineBoxAndOffset()
+        https://bugs.webkit.org/show_bug.cgi?id=33864
+        <rdar://problem/7552959>
+        
+        Regression has been introduced by changeset 53085.
+        The original fix had to be limited to editable content.
+
+        Test: editing/selection/selection-applet.html
+
+        * dom/Position.cpp:
+        (WebCore::Position::getInlineBoxAndOffset):
+
 2010-01-19  Kristian Amlie <kristian.amlie at nokia.com>
 
         Reviewed by Laszlo Gombos.
diff --git a/WebCore/dom/Position.cpp b/WebCore/dom/Position.cpp
index 592cd2c..a679237 100644
--- a/WebCore/dom/Position.cpp
+++ b/WebCore/dom/Position.cpp
@@ -1013,11 +1013,12 @@ void Position::getInlineBoxAndOffset(EAffinity affinity, TextDirection primaryDi
                 return;
             }
         }
+        inlineBox = 0;
         if (renderer->isBox()) {
             inlineBox = toRenderBox(renderer)->inlineBoxWrapper();
             if (!inlineBox || (caretOffset > inlineBox->caretMinOffset() && caretOffset < inlineBox->caretMaxOffset()))
                 return;
-        } else {
+        } else if (node()->isContentEditable()) {
             Position pos = positionInParentBeforeNode(node()).upstream();
             pos.getInlineBoxAndOffset(DOWNSTREAM, primaryDirection, inlineBox, caretOffset);
             return;

-- 
WebKit Debian packaging

