[Webkit-unassigned] [Bug 93247] REGRESSION(r124739): fast/lists/list-marker-remove-crash.html hits an assertion in MoveParagraphs
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Tue Feb 26 04:39:20 PST 2013
https://bugs.webkit.org/show_bug.cgi?id=93247
Andrei Bucur <abucur at adobe.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |abucur at adobe.com
--- Comment #12 from Andrei Bucur <abucur at adobe.com> 2013-02-26 04:41:43 PST ---
It seems we don't update the end position after updating start in InsertListCommand::listifyParagraph.
I'm really not familiar with that code, but common sense dictates we should do that (if start changed, why shouldn't end change as well?). Something around these lines:
// We inserted the list at the start of the content we're about to move
// Update the start of content, so we don't try to move the list into itself. bug 19066
// Layout is necessary since start's node's inline renderers may have been destroyed by the insertion
if (insertionPos == start.deepEquivalent()) {
listElement->document()->updateLayoutIgnorePendingStylesheets();
start = startOfParagraph(originalStart, CanSkipOverEditingBoundary);
+ end = endOfParagraph(start, CanSkipOverEditingBoundary);
}
After adding that new line the test doesn't crash any more. Is this the right fix?
--
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
More information about the webkit-unassigned
mailing list