[Webkit-unassigned] [Bug 142880] REGRESSION (r109593): Clicking after last inline element could cause a crash.
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Thu Mar 19 16:15:15 PDT 2015
https://bugs.webkit.org/show_bug.cgi?id=142880
Ryosuke Niwa <rniwa at webkit.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Attachment #249068|review? |review+
Flags| |
--- Comment #7 from Ryosuke Niwa <rniwa at webkit.org> ---
Comment on attachment 249068
--> https://bugs.webkit.org/attachment.cgi?id=249068
Patch2
View in context: https://bugs.webkit.org/attachment.cgi?id=249068&action=review
r=me provided you address the following comments.
> Source/WebCore/rendering/RootInlineBox.cpp:766
> - if (leftPosition <= firstLeaf->logicalLeft() && !firstLeaf->renderer().isListMarker() && (!onlyEditableLeaves || isEditableLeaf(firstLeaf)))
> + if (/*firstLeaf &&*/ leftPosition <= firstLeaf->logicalLeft() && !firstLeaf->renderer().isListMarker() && (!onlyEditableLeaves || isEditableLeaf(firstLeaf)))
Surely, you didn't mean to comment out this code?
> LayoutTests/editing/selection/click-after-last-inline-crash.html:1
> +<html>
Missing DOCTYPE.
> LayoutTests/editing/selection/click-after-last-inline-crash.html:16
> + var testElement = document.getElementById('test');
> + eventSender.mouseMoveTo(testElement.offsetLeft + testElement.offsetWidth + 50, testElement.offsetTop + 5);
> + eventSender.mouseDown();
> + eventSender.mouseUp();
Please wrap this code inside else.
Can we spit out "PASS" after running eventSender?
--
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20150319/99bb8e2a/attachment-0002.html>
More information about the webkit-unassigned
mailing list