Chromium Code Reviews (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out

Issue 5812003: Merge 73279 - 2010-12-03 Ryosuke Niwa <>... (Closed)

10 years ago by rniwa-cr
9 years, 6 months ago
Base URL:


Merge 73279 - 2010-12-03 Ryosuke Niwa <>; Reviewed by Darin Adler. REGRESSION: Crash when deleting text after textarea's value is modified on input event The crash was caused by TypingCommand::deleteKeyPressed's reusing a typing command for textarea's shadow DOM after its input event handler rewrote the value set by the typing command. Because the reused typing command's ending selection was pointing at a shadow node that has been detached from the document when the event handler set the new value, rootEditableElement of the ending selection was null and caused the crash. Fixed the bug by updating the ending selection of the last typing command when it differsfrom that of the current selection held by the SelectionController in TypingCommand::deleteKeyPressed. Also fixed similar bugs in forwardDeleteKeyPressed and insertText, and insertTextRunWithoutNewlines. Tests: editing/input/set-value-on-input-and-delete.html editing/input/set-value-on-input-and-forward-delete.html editing/input/set-value-on-input-and-type-input.html editing/input/set-value-on-input-and-type-textarea.html * editing/InsertTextCommand.h: Added TypingCommand as a friend because it needs to update selection. * editing/TypingCommand.cpp: (WebCore::TypingCommand::deleteKeyPressed): Updates the last typing command's selection as needed. (WebCore::TypingCommand::forwardDeleteKeyPressed): Ditto. (WebCore::TypingCommand::insertText): Ditto. (WebCore::TypingCommand::updateSelectionIfDifferentFromCurrentSelection): Added. (WebCore::TypingCommand::insertTextRunWithoutNewlines): Updates InsertTextCommand's selection as needed. * editing/TypingCommand.h: 2010-12-03 Ryosuke Niwa <>; Reviewed by Darin Adler. REGRESSION: Crash when deleting text after textarea's value is modified on input event Added tests to ensure inserting and deleting a character inside input or textarea succeeds even if the value of those elements have been rewritten by its input event handler. * editing/input/set-value-on-input-and-delete-expected.txt: Added. * editing/input/set-value-on-input-and-delete.html: Added. * editing/input/set-value-on-input-and-forward-delete-expected.txt: Added. * editing/input/set-value-on-input-and-forward-delete.html: Added. * editing/input/set-value-on-input-and-type-input-expected.txt: Added. * editing/input/set-value-on-input-and-type-input.html: Added. * editing/input/set-value-on-input-and-type-textarea-expected.txt: Added. * editing/input/set-value-on-input-and-type-textarea.html: Added. BUG=62608 Committed:

Patch Set 1 #


Total messages: 1 (0 generated)
10 years ago (2010-12-13 19:11:19 UTC) #1


Powered by Google App Engine
This is Rietveld 408576698