Chromium Code Reviews| Index: Source/core/dom/Range.cpp |
| diff --git a/Source/core/dom/Range.cpp b/Source/core/dom/Range.cpp |
| index 9189f403bbb65bda280a75d7fa493fb648135f57..42cdf88f6004e3f495610b6666b9ab3c5ec43cec 100644 |
| --- a/Source/core/dom/Range.cpp |
| +++ b/Source/core/dom/Range.cpp |
| @@ -735,7 +735,7 @@ PassRefPtr<Node> Range::processContentsBetweenOffsets(ActionType action, PassRef |
| result = container->cloneNode(false); |
| } |
| - Node* n = container->firstChild(); |
| + Node* n = toContainerNode(container)->firstChild(); |
|
esprehn
2014/06/02 19:03:37
This is not safe, a DOCUMENT_TYPE_NODE is not a Co
Inactive
2014/06/02 20:36:18
Good catch, thanks.
Inactive
2014/06/02 20:46:25
I kept this change out for now.
|
| Vector<RefPtr<Node> > nodes; |
| for (unsigned i = startOffset; n && i; i--) |
| n = n->nextSibling(); |
| @@ -870,7 +870,7 @@ void Range::insertNode(PassRefPtr<Node> prpNewNode, ExceptionState& exceptionSta |
| if (newNodeType == Node::DOCUMENT_FRAGMENT_NODE && !newNode->isShadowRoot()) { |
| // check each child node, not the DocumentFragment itself |
| numNewChildren = 0; |
| - for (Node* c = newNode->firstChild(); c; c = c->nextSibling()) { |
| + for (Node* c = toDocumentFragment(newNode)->firstChild(); c; c = c->nextSibling()) { |
| if (!checkAgainst->childTypeAllowed(c->nodeType())) { |
| exceptionState.throwDOMException(HierarchyRequestError, "The node to be inserted contains a '" + c->nodeName() + "' node, which may not be inserted here."); |
| return; |
| @@ -923,11 +923,11 @@ void Range::insertNode(PassRefPtr<Node> prpNewNode, ExceptionState& exceptionSta |
| if (collapsed) |
| m_end.setToBeforeChild(*newText); |
| } else { |
| - RefPtr<Node> lastChild = (newNodeType == Node::DOCUMENT_FRAGMENT_NODE) ? newNode->lastChild() : newNode; |
| + RefPtr<Node> lastChild = (newNodeType == Node::DOCUMENT_FRAGMENT_NODE) ? toDocumentFragment(newNode)->lastChild() : newNode; |
| if (lastChild && lastChild == m_start.childBefore()) { |
| // The insertion will do nothing, but we need to extend the range to include |
| // the inserted nodes. |
| - Node* firstChild = (newNodeType == Node::DOCUMENT_FRAGMENT_NODE) ? newNode->firstChild() : newNode.get(); |
| + Node* firstChild = (newNodeType == Node::DOCUMENT_FRAGMENT_NODE) ? toDocumentFragment(newNode)->firstChild() : newNode.get(); |
| ASSERT(firstChild); |
| m_start.setToBeforeChild(*firstChild); |
| return; |