diff options
| author | Allan Sandfeld Jensen <allan.jensen@digia.com> | 2013-01-23 16:00:03 +0100 |
|---|---|---|
| committer | The Qt Project <gerrit-noreply@qt-project.org> | 2013-01-23 18:59:26 +0100 |
| commit | 344fe6c13f8cfa63b512f558aeb90d8fe9bff990 (patch) | |
| tree | 670a5aa28c5a9e616cca6d6427bb1973f28888c3 /Source/JavaScriptCore/runtime/JSObject.cpp | |
| parent | c0a3b64d8e6f8eac5a8e65cdb337e24e112da2c3 (diff) | |
| download | qtwebkit-344fe6c13f8cfa63b512f558aeb90d8fe9bff990.tar.gz | |
Crash in WebCore::Element::cloneElementWithoutChildren
https://bugs.webkit.org/show_bug.cgi?id=105949
Reviewed by Ryosuke Niwa.
RefPtr |ancestors| vector since its elements can be destroyed from mutation events
fired in CompositeEditCommand::appendNode.
No new tests. The testcase relies on recursive DOM mutations and does not minimize.
* editing/InsertParagraphSeparatorCommand.cpp:
(WebCore::InsertParagraphSeparatorCommand::getAncestorsInsideBlock):
(WebCore::InsertParagraphSeparatorCommand::cloneHierarchyUnderNewBlock):
(WebCore::InsertParagraphSeparatorCommand::doApply):
* editing/InsertParagraphSeparatorCommand.h:
(InsertParagraphSeparatorCommand):
Change-Id: I8792007dd6b3d397c7885943400eb5193a701edd
Reviewed-by: Simon Hausmann <simon.hausmann@digia.com>
Diffstat (limited to 'Source/JavaScriptCore/runtime/JSObject.cpp')
0 files changed, 0 insertions, 0 deletions