Merge 72863 - Crash when iframe transfers from one page to another and has ch...

WebCore/ChangeLog

Index: WebCore/ChangeLog
===================================================================
--- WebCore/ChangeLog	(revision 73175)
+++ WebCore/ChangeLog	(working copy)
@@ -1,26 +1,36 @@
-2010-12-01  Ryosuke Niwa  <rniwa@webkit.org>
+2010-11-29  Dmitry Titov  <dimich@chromium.org>
 
-        Reviewed by Darin Adler, Tony Chang, and unofficially by Enrica Casucci.
+        Reviewed by David Levin.
 
-        chrome.dll!WebCore::RangeBoundaryPoint::toPosition ReadAV@NULL (cf0d0f28bc56f2591cc74f71b46036ea)
-        https://bugs.webkit.org/show_bug.cgi?id=47808
+        Crash when iframe transfers from one page to another and has child frames.
+        https://bugs.webkit.org/show_bug.cgi?id=50200
 
-        The crash was caused by moveParagraphWithClones' not copying the entire paragraph
-        when called by doApplyForSingleParagraph, which was induced by a bug in
-        cloneParagraphUnderNewElement which ended the cloning process early when the start node
-        and the end node didn't share the same parent node. Fixed the bug in cloneParagraphUnderNewElement
-        by calling traverseNextSibling(outerNode) instead of nextSibling().
+        * page/Frame.cpp:
+        (WebCore::Frame::transferChildFrameToNewDocument):
+        avoid overriding 'didTransfer' which has the result of previous check.
 
-        Also added an early exit to InsertListCommand::doApply when lastSelectionRange is null.
+2010-11-19  Ryosuke Niwa  <rniwa@webkit.org>
 
-        Tests: editing/execCommand/switch-multiple-list-items-crash.html
-               editing/execCommand/switch-multiple-list-items.html
+        Reviewed by David Hyatt.
 
-        * editing/CompositeEditCommand.cpp:
-        (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement):
-        * editing/InsertListCommand.cpp:
-        (WebCore::InsertListCommand::doApply):
+        up arrow doesn't work with RTL text with word wrapping
+        https://bugs.webkit.org/show_bug.cgi?id=41987
 
+        The bug was caused by positionForPoint's not returning the correct affinity when the x coordiate
+        is to the left of the first line, and startOfLine's incorrectly moving position to the previous candidate.
+
+        Fixed the bug by returning upstream VisiblePosition in positionForPoint if the first inline text box's offset
+        is greater than 0.  Also removed the code added by http://trac.webkit.org/changeset/23608 since this changeset
+        does not add any test, and the problem described in the changelog reproduces regardless of the code's presence.
+
+        Tests: editing/selection/click-left-of-rtl-wrapping-text.html
+               editing/selection/modify-up-on-rtl-wrapping-text.html
+
+        * editing/visible_units.cpp:
+        (WebCore::startOfLine):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::positionForPoint):
+
 2010-11-29  Ilya Sherman  <isherman@chromium.org>
 
         Reviewed by Kent Tamura.