Crash in WebCore::Element::cloneElementWithoutChildren
authorAllan Sandfeld Jensen <allan.jensen@digia.com>
Wed, 23 Jan 2013 15:00:03 +0000 (16:00 +0100)
committerThe Qt Project <gerrit-noreply@qt-project.org>
Wed, 23 Jan 2013 17:59:26 +0000 (18:59 +0100)
commit344fe6c13f8cfa63b512f558aeb90d8fe9bff990
tree670a5aa28c5a9e616cca6d6427bb1973f28888c3
parentc0a3b64d8e6f8eac5a8e65cdb337e24e112da2c3
Crash in WebCore::Element::cloneElementWithoutChildren

https://bugs.webkit.org/show_bug.cgi?id=105949

Reviewed by Ryosuke Niwa.

RefPtr |ancestors| vector since its elements can be destroyed from mutation events
fired in CompositeEditCommand::appendNode.

No new tests. The testcase relies on recursive DOM mutations and does not minimize.

* editing/InsertParagraphSeparatorCommand.cpp:
(WebCore::InsertParagraphSeparatorCommand::getAncestorsInsideBlock):
(WebCore::InsertParagraphSeparatorCommand::cloneHierarchyUnderNewBlock):
(WebCore::InsertParagraphSeparatorCommand::doApply):
* editing/InsertParagraphSeparatorCommand.h:
(InsertParagraphSeparatorCommand):

Change-Id: I8792007dd6b3d397c7885943400eb5193a701edd
Reviewed-by: Simon Hausmann <simon.hausmann@digia.com>
Source/WebCore/ChangeLog
Source/WebCore/editing/InsertParagraphSeparatorCommand.cpp
Source/WebCore/editing/InsertParagraphSeparatorCommand.h