[Webkit-unassigned] [Bug 93247] REGRESSION(r124739): fast/lists/list-marker-remove-crash.html hits an assertion in MoveParagraphs

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=93247


Andrei Bucur <abucur at adobe.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |abucur at adobe.com




--- Comment #12 from Andrei Bucur <abucur at adobe.com>  2013-02-26 04:41:43 PST ---
It seems we don't update the end position after updating start in InsertListCommand::listifyParagraph.
I'm really not familiar with that code, but common sense dictates we should do that (if start changed, why shouldn't end change as well?). Something around these lines:

        // We inserted the list at the start of the content we're about to move
        // Update the start of content, so we don't try to move the list into itself.  bug 19066
        // Layout is necessary since start's node's inline renderers may have been destroyed by the insertion
        if (insertionPos == start.deepEquivalent()) {
            listElement->document()->updateLayoutIgnorePendingStylesheets();
            start = startOfParagraph(originalStart, CanSkipOverEditingBoundary);
+            end = endOfParagraph(start, CanSkipOverEditingBoundary);
        }

After adding that new line the test doesn't crash any more. Is this the right fix?

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.