Diff
Modified: branches/safari-604-branch/LayoutTests/ChangeLog (223091 => 223092)
--- branches/safari-604-branch/LayoutTests/ChangeLog 2017-10-10 00:07:48 UTC (rev 223091)
+++ branches/safari-604-branch/LayoutTests/ChangeLog 2017-10-10 00:07:48 UTC (rev 223092)
@@ -1,5 +1,22 @@
2017-10-02 Jason Marcell <[email protected]>
+ Cherry-pick r221128. rdar://problem/34771005
+
+ 2017-08-23 Wenson Hsieh <[email protected]>
+
+ DeleteSelectionCommand should be robust when starting and ending editable positions cannot be found
+ https://bugs.webkit.org/show_bug.cgi?id=175914
+ <rdar://problem/29792688>
+
+ Reviewed by Ryosuke Niwa.
+
+ Adds a new LayoutTest. This test passes if WebKit successfully loaded the page.
+
+ * editing/execCommand/forward-delete-read-write-canvas-expected.txt: Added.
+ * editing/execCommand/forward-delete-read-write-canvas.html: Added.
+
+2017-10-02 Jason Marcell <[email protected]>
+
Cherry-pick r220718. rdar://problem/34771041
2017-08-14 Andy Estes <[email protected]>
Added: branches/safari-604-branch/LayoutTests/editing/execCommand/forward-delete-read-write-canvas-expected.txt (0 => 223092)
--- branches/safari-604-branch/LayoutTests/editing/execCommand/forward-delete-read-write-canvas-expected.txt (rev 0)
+++ branches/safari-604-branch/LayoutTests/editing/execCommand/forward-delete-read-write-canvas-expected.txt 2017-10-10 00:07:48 UTC (rev 223092)
@@ -0,0 +1 @@
+PASS
Added: branches/safari-604-branch/LayoutTests/editing/execCommand/forward-delete-read-write-canvas.html (0 => 223092)
--- branches/safari-604-branch/LayoutTests/editing/execCommand/forward-delete-read-write-canvas.html (rev 0)
+++ branches/safari-604-branch/LayoutTests/editing/execCommand/forward-delete-read-write-canvas.html 2017-10-10 00:07:48 UTC (rev 223092)
@@ -0,0 +1,9 @@
+<code style="color: green">PASS</code>
+<canvas style="-webkit-user-modify: read-write"><span><input id="input"></input></span></canvas>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+input.focus();
+input.remove();
+document.execCommand("ForwardDelete");
+</script>
Modified: branches/safari-604-branch/Source/WebCore/ChangeLog (223091 => 223092)
--- branches/safari-604-branch/Source/WebCore/ChangeLog 2017-10-10 00:07:48 UTC (rev 223091)
+++ branches/safari-604-branch/Source/WebCore/ChangeLog 2017-10-10 00:07:48 UTC (rev 223092)
@@ -1,5 +1,33 @@
2017-10-02 Jason Marcell <[email protected]>
+ Cherry-pick r221128. rdar://problem/34771005
+
+ 2017-08-23 Wenson Hsieh <[email protected]>
+
+ DeleteSelectionCommand should be robust when starting and ending editable positions cannot be found
+ https://bugs.webkit.org/show_bug.cgi?id=175914
+ <rdar://problem/29792688>
+
+ Reviewed by Ryosuke Niwa.
+
+ DeleteSelectionCommand can cause a null dereference if editable start and end positions are not found. This can
+ happen when attempting to delete after selecting the contents within a canvas or output element with `read-write`
+ `-webkit-user-modify` style. To fix this, we make the initialization step of the DeleteSelectionCommand robust
+ when editable start and end positions are missing.
+
+ Test: editing/execCommand/forward-delete-read-write-canvas.html
+
+ * editing/DeleteSelectionCommand.cpp:
+ (WebCore::DeleteSelectionCommand::initializePositionData):
+
+ Make this initialization helper indicate failure via a bool return value. DeleteSelectionCommand::doApply bails
+ early if initializePositionData returned false.
+
+ (WebCore::DeleteSelectionCommand::doApply):
+ * editing/DeleteSelectionCommand.h:
+
+2017-10-02 Jason Marcell <[email protected]>
+
Cherry-pick r221116. rdar://problem/34771068
2017-08-23 Jer Noble <[email protected]>
Modified: branches/safari-604-branch/Source/WebCore/editing/DeleteSelectionCommand.cpp (223091 => 223092)
--- branches/safari-604-branch/Source/WebCore/editing/DeleteSelectionCommand.cpp 2017-10-10 00:07:48 UTC (rev 223091)
+++ branches/safari-604-branch/Source/WebCore/editing/DeleteSelectionCommand.cpp 2017-10-10 00:07:48 UTC (rev 223092)
@@ -172,7 +172,7 @@
setStartingSelection(VisibleSelection(newBase, newExtent, startingSelection().isDirectional()));
}
-void DeleteSelectionCommand::initializePositionData()
+bool DeleteSelectionCommand::initializePositionData()
{
Position start, end;
initializeStartEnd(start, end);
@@ -182,6 +182,9 @@
if (!isEditablePosition(end, ContentIsEditable))
end = lastEditablePositionBeforePositionInRoot(end, highestEditableRoot(start));
+ if (start.isNull() || end.isNull())
+ return false;
+
m_upstreamStart = start.upstream();
m_downstreamStart = start.downstream();
m_upstreamEnd = end.upstream();
@@ -272,6 +275,8 @@
// node. This was done to match existing behavior, but it seems wrong.
m_startBlock = enclosingNodeOfType(m_downstreamStart.parentAnchoredEquivalent(), &isBlock, CanCrossEditingBoundary);
m_endBlock = enclosingNodeOfType(m_upstreamEnd.parentAnchoredEquivalent(), &isBlock, CanCrossEditingBoundary);
+
+ return true;
}
void DeleteSelectionCommand::saveTypingStyleState()
@@ -857,7 +862,8 @@
// set up our state
- initializePositionData();
+ if (!initializePositionData())
+ return;
// Delete any text that may hinder our ability to fixup whitespace after the delete
deleteInsignificantTextDownstream(m_trailingWhitespace);
Modified: branches/safari-604-branch/Source/WebCore/editing/DeleteSelectionCommand.h (223091 => 223092)
--- branches/safari-604-branch/Source/WebCore/editing/DeleteSelectionCommand.h 2017-10-10 00:07:48 UTC (rev 223091)
+++ branches/safari-604-branch/Source/WebCore/editing/DeleteSelectionCommand.h 2017-10-10 00:07:48 UTC (rev 223092)
@@ -54,7 +54,7 @@
void initializeStartEnd(Position&, Position&);
void setStartingSelectionOnSmartDelete(const Position&, const Position&);
- void initializePositionData();
+ bool initializePositionData();
void saveTypingStyleState();
void insertPlaceholderForAncestorBlockContent();
bool handleSpecialCaseBRDelete();
