Index: Source/core/dom/Range.cpp |
diff --git a/Source/core/dom/Range.cpp b/Source/core/dom/Range.cpp |
index 9189f403bbb65bda280a75d7fa493fb648135f57..42cdf88f6004e3f495610b6666b9ab3c5ec43cec 100644 |
--- a/Source/core/dom/Range.cpp |
+++ b/Source/core/dom/Range.cpp |
@@ -735,7 +735,7 @@ PassRefPtr<Node> Range::processContentsBetweenOffsets(ActionType action, PassRef |
result = container->cloneNode(false); |
} |
- Node* n = container->firstChild(); |
+ Node* n = toContainerNode(container)->firstChild(); |
esprehn
2014/06/02 19:03:37
This is not safe, a DOCUMENT_TYPE_NODE is not a Co
Inactive
2014/06/02 20:36:18
Good catch, thanks.
Inactive
2014/06/02 20:46:25
I kept this change out for now.
|
Vector<RefPtr<Node> > nodes; |
for (unsigned i = startOffset; n && i; i--) |
n = n->nextSibling(); |
@@ -870,7 +870,7 @@ void Range::insertNode(PassRefPtr<Node> prpNewNode, ExceptionState& exceptionSta |
if (newNodeType == Node::DOCUMENT_FRAGMENT_NODE && !newNode->isShadowRoot()) { |
// check each child node, not the DocumentFragment itself |
numNewChildren = 0; |
- for (Node* c = newNode->firstChild(); c; c = c->nextSibling()) { |
+ for (Node* c = toDocumentFragment(newNode)->firstChild(); c; c = c->nextSibling()) { |
if (!checkAgainst->childTypeAllowed(c->nodeType())) { |
exceptionState.throwDOMException(HierarchyRequestError, "The node to be inserted contains a '" + c->nodeName() + "' node, which may not be inserted here."); |
return; |
@@ -923,11 +923,11 @@ void Range::insertNode(PassRefPtr<Node> prpNewNode, ExceptionState& exceptionSta |
if (collapsed) |
m_end.setToBeforeChild(*newText); |
} else { |
- RefPtr<Node> lastChild = (newNodeType == Node::DOCUMENT_FRAGMENT_NODE) ? newNode->lastChild() : newNode; |
+ RefPtr<Node> lastChild = (newNodeType == Node::DOCUMENT_FRAGMENT_NODE) ? toDocumentFragment(newNode)->lastChild() : newNode; |
if (lastChild && lastChild == m_start.childBefore()) { |
// The insertion will do nothing, but we need to extend the range to include |
// the inserted nodes. |
- Node* firstChild = (newNodeType == Node::DOCUMENT_FRAGMENT_NODE) ? newNode->firstChild() : newNode.get(); |
+ Node* firstChild = (newNodeType == Node::DOCUMENT_FRAGMENT_NODE) ? toDocumentFragment(newNode)->firstChild() : newNode.get(); |
ASSERT(firstChild); |
m_start.setToBeforeChild(*firstChild); |
return; |