[Webkit-unassigned] [Bug 142880] REGRESSION (r109593): Clicking after last inline element could cause a crash.

Thu Mar 19 16:15:15 PDT 2015

https://bugs.webkit.org/show_bug.cgi?id=142880

Ryosuke Niwa <rniwa at webkit.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
 Attachment #249068|review?                     |review+
              Flags|                            |

--- Comment #7 from Ryosuke Niwa <rniwa at webkit.org> ---
Comment on attachment 249068
  --> https://bugs.webkit.org/attachment.cgi?id=249068
Patch2

View in context: https://bugs.webkit.org/attachment.cgi?id=249068&action=review

r=me provided you address the following comments.

> Source/WebCore/rendering/RootInlineBox.cpp:766
> -    if (leftPosition <= firstLeaf->logicalLeft() && !firstLeaf->renderer().isListMarker() && (!onlyEditableLeaves || isEditableLeaf(firstLeaf)))
> +    if (/*firstLeaf &&*/ leftPosition <= firstLeaf->logicalLeft() && !firstLeaf->renderer().isListMarker() && (!onlyEditableLeaves || isEditableLeaf(firstLeaf)))

Surely, you didn't mean to comment out this code?

> LayoutTests/editing/selection/click-after-last-inline-crash.html:1
> +<html>

Missing DOCTYPE.

> LayoutTests/editing/selection/click-after-last-inline-crash.html:16
> +    var testElement = document.getElementById('test');
> +    eventSender.mouseMoveTo(testElement.offsetLeft + testElement.offsetWidth + 50, testElement.offsetTop + 5);
> +    eventSender.mouseDown();
> +    eventSender.mouseUp();

Please wrap this code inside else.
Can we spit out "PASS" after running eventSender?

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20150319/99bb8e2a/attachment-0002.html>