[webkit-reviews] review requested: [Bug 30083] Data loss occurs when unbolding nested bold tags. : [Attachment 41369] Fixes the loop in swapInNodePreservingAttributesAndChildren

[bugzilla-daemon at webkit.org]

Ryosuke Niwa <rniwa at webkit.org> has asked  for review:
Bug 30083: Data loss occurs when unbolding nested bold tags.
https://bugs.webkit.org/show_bug.cgi?id=30083

Attachment 41369: Fixes the loop in swapInNodePreservingAttributesAndChildren
https://bugs.webkit.org/attachment.cgi?id=41369&action=review

------- Additional Comments from Ryosuke Niwa <rniwa at webkit.org>
It turned out that the bug resided in
swapInNodePreservingAttributesAndChildren:

https://trac.webkit.org/browser/trunk/WebCore/editing/ReplaceNodeWithSpanComman
d.cpp#L60

60	    for (Node* child = nodeToReplace->firstChild(); child; child =
child->nextSibling()) {
61		newNode->appendChild(child, ec);
62		ASSERT(!ec);
63	    }

As soon as we appendChild to newNode in L61, nextSibling() is changed to 0.
In my patch, I introduced Node* nextChild to temporarily save the pointer.