From kde-commits  Sat Mar 22 14:55:18 2008
From: Harri Porten <porten () kde ! org>
Date: Sat, 22 Mar 2008 14:55:18 +0000
To: kde-commits
Subject: branches/KDE/4.0/kdelibs/khtml/xml
Message-Id: <1206197718.714946.12682.nullmailer () svn ! kde ! org>
X-MARC-Message: https://marc.info/?l=kde-commits&m=120619772708007

SVN commit 788806 by porten:

Same fix as the one I did for toString() yesterday: a 0 end offset
means we don't have to dive into the end container at all.

This time I used WebCore r7649 to fix it as it also brings
some sanity checks for offset overflows.


 M  +20 -16    dom2_rangeimpl.cpp  


--- branches/KDE/4.0/kdelibs/khtml/xml/dom2_rangeimpl.cpp #788805:788806
@@ -457,7 +457,7 @@
         else {
             NodeImpl *n = m_startContainer->firstChild();
             unsigned long i;
-            for(i = 0; i < m_startOffset; i++) // skip until m_startOffset
+            for (i = 0; n && i < m_startOffset; i++) // skip until m_startOffset
                 n = n->nextSibling();
             while (n && i < m_endOffset) { // delete until m_endOffset
 		NodeImpl *next = n->nextSibling();
@@ -517,8 +517,7 @@
             if (action == EXTRACT_CONTENTS || action == CLONE_CONTENTS)
 		leftContents = m_startContainer->cloneNode(false);
             NodeImpl *n = m_startContainer->firstChild();
-            unsigned long i;
-            for(i = 0; i < m_startOffset; i++) // skip until m_startOffset
+            for (unsigned long i = 0; n && i < m_startOffset; i++) // skip until m_startOffset
                 n = n->nextSibling();
             while (n) { // process until end
 		NodeImpl *next = n->nextSibling();
@@ -542,7 +541,7 @@
 	    }
 
             NodeImpl *next;
-            for (; n; n = next ) {
+            for (; n; n = next) {
                 next = n->nextSibling();
                 if (action == EXTRACT_CONTENTS)
                     leftContents->appendChild(n,exceptioncode); // will remove n from leftParent
@@ -579,18 +578,23 @@
 	    if (action == EXTRACT_CONTENTS || action == CLONE_CONTENTS)
 		rightContents = m_endContainer->cloneNode(false);
             NodeImpl *n = m_endContainer->firstChild();
-            unsigned long i;
-            for(i = 0; i+1 < m_endOffset; i++) // skip to m_endOffset
-                n = n->nextSibling();
-            NodeImpl *prev;
-            for (; n; n = prev ) {
-                prev = n->previousSibling();
-                if (action == EXTRACT_CONTENTS)
-                    rightContents->insertBefore(n,rightContents->firstChild(),exceptioncode); // will remove n from its parent
-                else if (action == CLONE_CONTENTS)
-                    rightContents->insertBefore(n->cloneNode(true),rightContents->firstChild(),exceptioncode);
-                else
-                    m_endContainer->removeChild(n,exceptioncode);
+            if (n && m_endOffset) {
+                for(unsigned long i = 0; i+1 < m_endOffset; i++) { // skip to m_endOffset
+                    NodeImpl* next = n->nextSibling(); 
+                    if (!next) 
+                        break; 
+                    n = next; 
+                }
+                NodeImpl *prev;
+                for (; n; n = prev) {
+                    prev = n->previousSibling();
+                    if (action == EXTRACT_CONTENTS)
+                        rightContents->insertBefore(n,rightContents->firstChild(),exceptioncode); // will remove n from its parent
+                    else if (action == CLONE_CONTENTS)
+                        rightContents->insertBefore(n->cloneNode(true),rightContents->firstChild(),exceptioncode);
+                    else
+                        m_endContainer->removeChild(n,exceptioncode);
+                }
             }
         }