Title: [259624] trunk
- Revision
- 259624
- Author
- [email protected]
- Date
- 2020-04-06 23:29:24 -0700 (Mon, 06 Apr 2020)
Log Message
Nullptr crash in CompositeEditCommand::splitTreeToNode when inserting image in anchor element that has uneditable parent
https://bugs.webkit.org/show_bug.cgi?id=210004
<rdar://problem/61206583>
Reviewed by Ryosuke Niwa.
Source/WebCore:
RemoveNodePreservingChildren can fail and leave the children dangling if the parent of the node
is uneditable. Added editability check for the to-be-removed node.
Test: editing/inserting/insert-img-anchor-uneditable-parent.html
* editing/RemoveNodePreservingChildrenCommand.cpp:
(WebCore::RemoveNodePreservingChildrenCommand::doApply):
LayoutTests:
Added a regression test for the crash.
* editing/inserting/insert-img-anchor-uneditable-parent-expected.txt: Added.
* editing/inserting/insert-img-anchor-uneditable-parent.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (259623 => 259624)
--- trunk/LayoutTests/ChangeLog 2020-04-07 04:59:57 UTC (rev 259623)
+++ trunk/LayoutTests/ChangeLog 2020-04-07 06:29:24 UTC (rev 259624)
@@ -1,3 +1,16 @@
+2020-04-06 Jack Lee <[email protected]>
+
+ Nullptr crash in CompositeEditCommand::splitTreeToNode when inserting image in anchor element that has uneditable parent
+ https://bugs.webkit.org/show_bug.cgi?id=210004
+ <rdar://problem/61206583>
+
+ Reviewed by Ryosuke Niwa.
+
+ Added a regression test for the crash.
+
+ * editing/inserting/insert-img-anchor-uneditable-parent-expected.txt: Added.
+ * editing/inserting/insert-img-anchor-uneditable-parent.html: Added.
+
2020-04-06 Lauro Moura <[email protected]>
[GTK][WPE] Gardening EXIF orientation failure.
Added: trunk/LayoutTests/editing/inserting/insert-img-anchor-uneditable-parent-expected.txt (0 => 259624)
--- trunk/LayoutTests/editing/inserting/insert-img-anchor-uneditable-parent-expected.txt (rev 0)
+++ trunk/LayoutTests/editing/inserting/insert-img-anchor-uneditable-parent-expected.txt 2020-04-07 06:29:24 UTC (rev 259624)
@@ -0,0 +1,3 @@
+Test inserting image in anchor element that has uneditable parent. The test passes if WebKit doesn't crash or hit an assertion.
+
+
Added: trunk/LayoutTests/editing/inserting/insert-img-anchor-uneditable-parent.html (0 => 259624)
--- trunk/LayoutTests/editing/inserting/insert-img-anchor-uneditable-parent.html (rev 0)
+++ trunk/LayoutTests/editing/inserting/insert-img-anchor-uneditable-parent.html 2020-04-07 06:29:24 UTC (rev 259624)
@@ -0,0 +1,13 @@
+<a contentEditable=true href="" inserting image in anchor element that has uneditable parent. The test passes if WebKit doesn't crash or hit an assertion.</span><br id=BR></br>
+<script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+
+ window._onload_ = () => {
+ window.getSelection().collapse(BR);
+ document.execCommand("selectAll", false);
+ document.execCommand("fontName", false, "Times Roman");
+ document.getSelection().collapseToStart();
+ window.document.execCommand("insertImage", "#foo");
+ }
+</script>
Modified: trunk/Source/WebCore/ChangeLog (259623 => 259624)
--- trunk/Source/WebCore/ChangeLog 2020-04-07 04:59:57 UTC (rev 259623)
+++ trunk/Source/WebCore/ChangeLog 2020-04-07 06:29:24 UTC (rev 259624)
@@ -1,3 +1,19 @@
+2020-04-06 Jack Lee <[email protected]>
+
+ Nullptr crash in CompositeEditCommand::splitTreeToNode when inserting image in anchor element that has uneditable parent
+ https://bugs.webkit.org/show_bug.cgi?id=210004
+ <rdar://problem/61206583>
+
+ Reviewed by Ryosuke Niwa.
+
+ RemoveNodePreservingChildren can fail and leave the children dangling if the parent of the node
+ is uneditable. Added editability check for the to-be-removed node.
+
+ Test: editing/inserting/insert-img-anchor-uneditable-parent.html
+
+ * editing/RemoveNodePreservingChildrenCommand.cpp:
+ (WebCore::RemoveNodePreservingChildrenCommand::doApply):
+
2020-04-06 David Kilzer <[email protected]>
Use-after-move of Vector<ManipulationToken> in TextManipulationController::observeParagraphs()
Modified: trunk/Source/WebCore/editing/RemoveNodePreservingChildrenCommand.cpp (259623 => 259624)
--- trunk/Source/WebCore/editing/RemoveNodePreservingChildrenCommand.cpp 2020-04-07 04:59:57 UTC (rev 259623)
+++ trunk/Source/WebCore/editing/RemoveNodePreservingChildrenCommand.cpp 2020-04-07 06:29:24 UTC (rev 259624)
@@ -41,6 +41,10 @@
void RemoveNodePreservingChildrenCommand::doApply()
{
Vector<Ref<Node>> children;
+ auto parent = makeRefPtr(m_node->parentNode());
+ if (!parent || (m_shouldAssumeContentIsAlwaysEditable == DoNotAssumeContentIsAlwaysEditable && !isEditableNode(*parent)))
+ return;
+
for (Node* child = m_node->firstChild(); child; child = child->nextSibling())
children.append(*child);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
