Merge 74979 - Merge 73801

WebCore/editing/ReplaceSelectionCommand.cpp

 /*
  * Copyright (C) 2005, 2006, 2008 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 32 matching lines @@
 #include "HTMLInputElement.h"
 #include "HTMLInterchange.h"
 #include "HTMLNames.h"
 #include "SelectionController.h"
 #include "SmartReplace.h"
 #include "TextIterator.h"
 #include "htmlediting.h"
 #include "markup.h"
 #include "visible_units.h"
 #include <wtf/StdLibExtras.h>
+#include <wtf/Vector.h>
 
 namespace WebCore {
 
+typedef Vector<RefPtr<Node> > NodeVector;
+
 using namespace HTMLNames;
 
 enum EFragmentType { EmptyFragment, SingleTextNodeFragment, TreeFragment };
 
 // --- ReplacementFragment helper class
 
 class ReplacementFragment : public Noncopyable {
 public:
     ReplacementFragment(Document*, DocumentFragment*, bool matchStyle, const VisibleSelection&);
 
@@ skipping 609 matching lines @@
     // appears redundant.
     setNodeAttribute(static_cast<Element*>(copiedRangeStyleSpan), styleAttr, copiedRangeStyle->style()->cssText());
 }
 
 // Take the style attribute of a span and apply it to it's children instead.  This allows us to
 // convert invalid HTML where a span contains block elements into valid HTML while preserving
 // styles.
 void ReplaceSelectionCommand::copyStyleToChildren(Node* parentNode, const CSSMutableStyleDeclaration* parentStyle)
 {
     ASSERT(parentNode->hasTagName(spanTag));
-    for (Node* childNode = parentNode->firstChild(); childNode; childNode = childNode->nextSibling()) {
+    NodeVector childNodes;
+    for (RefPtr<Node> childNode = parentNode->firstChild(); childNode; childNode = childNode->nextSibling())
+        childNodes.append(childNode);
+        
+    for (NodeVector::const_iterator it = childNodes.begin(); it != childNodes.end(); it++) {
+        Node* childNode = it->get();
         if (childNode->isTextNode() || !isBlock(childNode) || childNode->hasTagName(preTag)) {
             // In this case, put a span tag around the child node.
             RefPtr<Node> newNode = parentNode->cloneNode(false);
             ASSERT(newNode->hasTagName(spanTag));
             HTMLElement* newSpan = static_cast<HTMLElement*>(newNode.get());
             setNodeAttribute(newSpan, styleAttr, parentStyle->cssText());
             insertNodeAfter(newSpan, childNode);
             ExceptionCode ec = 0;
             newSpan->appendChild(childNode, ec);
             ASSERT(!ec);
@@ skipping 161 matching lines @@
         // This will leave a br between the split. 
         Node* br = endingSelection().start().node(); 
         ASSERT(br->hasTagName(brTag)); 
         // Insert content between the two blockquotes, but remove the br (since it was just a placeholder). 
         insertionPos = positionInParentBeforeNode(br);
         removeNode(br);
     }
     
     // Inserting content could cause whitespace to collapse, e.g. inserting <div>foo</div> into hello^ world.
     prepareWhitespaceAtPositionForSplit(insertionPos);
+
+    // If the downstream node has been removed there's no point in continuing.
+    if (!insertionPos.downstream().node())
+      return;
     
     // NOTE: This would be an incorrect usage of downstream() if downstream() were changed to mean the last position after 
     // p that maps to the same visible position as p (since in the case where a br is at the end of a block and collapsed 
     // away, there are positions after the br which map to the same visible position as [br, 0]).  
     Node* endBR = insertionPos.downstream().node()->hasTagName(brTag) ? insertionPos.downstream().node() : 0;
     VisiblePosition originalVisPosBeforeEndBR;
     if (endBR)
         originalVisPosBeforeEndBR = VisiblePosition(endBR, 0, DOWNSTREAM).previous();
     
     startBlock = enclosingBlock(insertionPos.node());
@@ skipping 58 matching lines @@
     else
         insertNodeAtAndUpdateNodesInserted(refNode, insertionPos);
 
     // Mutation events (bug 22634) may have already removed the inserted content
     if (!refNode->inDocument())
         return;
 
     bool plainTextFragment = isPlainTextMarkup(refNode.get());
 
     while (node) {
-        Node* next = node->nextSibling();
-        fragment.removeNode(node);
+        RefPtr<Node> next = node->nextSibling();
+        fragment.removeNode(node.get());
         insertNodeAfterAndUpdateNodesInserted(node, refNode.get());
 
         // Mutation events (bug 22634) may have already removed the inserted content
         if (!node->inDocument())
             return;
 
         refNode = node;
         if (node && plainTextFragment)
             plainTextFragment = isPlainTextMarkup(node.get());
         node = next;
@@ skipping 311 matching lines @@
     end = Position(start.anchorNode(), start.offsetInContainerNode() + text.length());
     
     VisibleSelection selectionAfterReplace(m_selectReplacement ? start : end, end);
     
     setEndingSelection(selectionAfterReplace);
     
     return true;
 }
 
 } // namespace WebCore