Chromium Code Reviews (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out

Unified Diff: Source/core/dom/Range.cpp

Issue 181283002: Fixing a crash in InsertListCommand. (Closed) Base URL:
Patch Set: Created 6 years, 10 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: Source/core/dom/Range.cpp
diff --git a/Source/core/dom/Range.cpp b/Source/core/dom/Range.cpp
index 85906a831541882178e89be7e9c85b864e07bc3a..315ef3bda3229e3f98788ea089f5ed519b606a3a 100644
--- a/Source/core/dom/Range.cpp
+++ b/Source/core/dom/Range.cpp
@@ -901,6 +901,11 @@ PassRefPtr<Node> Range::processAncestorsAndTheirSiblings(ActionType action, Node
Node* child = it->get();
switch (action) {
+ // ancestor->removeChild(<child before this child>) might cause the tree change
+ // because removeChild might call dispatchSubtreeModifiedEvent.
+ // Then we should validate again.
Yuta Kitamura 2014/02/26 10:41:16 nit: The first sentence sounds a little bit strang
yoichio 2014/02/27 04:00:03 Done.
+ if (ancestor != child->parentNode())
Yuta Kitamura 2014/02/26 10:41:16 Ideally, we could have bulk-removal functionality
yoichio 2014/02/27 04:00:03 Done.
+ break;
ancestor->removeChild(child, exceptionState);
case EXTRACT_CONTENTS: // will remove child from ancestor

Powered by Google App Engine
This is Rietveld 408576698