Title: [269137] trunk
- Revision
- 269137
- Author
- [email protected]
- Date
- 2020-10-28 22:26:10 -0700 (Wed, 28 Oct 2020)
Log Message
Null dereference in CompositeEditCommand::cloneParagraphUnderNewElement() due to not checking for top of DOM tree
https://bugs.webkit.org/show_bug.cgi?id=218132
Patch by Julian Gonzalez <[email protected]> on 2020-10-28
Reviewed by Ryosuke Niwa.
Source/WebCore:
When iterating through parent nodes, cloneParagraphUnderNewElement()
has to be careful to check for the top of the DOM tree (where
parentNode() returns nullptr) and stop iterating.
* editing/CompositeEditCommand.cpp:
(WebCore::CompositeEditCommand::cloneParagraphUnderNewElement):
LayoutTests:
Add a test to verify that we don't iterate outside the DOM tree while cloning a paragraph.
Thanks to Ryosuke Niwa for helping minimize the test and make it more stable.
* editing/deleting/move-paragraph-crash-expected.txt: Added.
* editing/deleting/move-paragraph-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (269136 => 269137)
--- trunk/LayoutTests/ChangeLog 2020-10-29 03:53:02 UTC (rev 269136)
+++ trunk/LayoutTests/ChangeLog 2020-10-29 05:26:10 UTC (rev 269137)
@@ -1,3 +1,16 @@
+2020-10-28 Julian Gonzalez <[email protected]>
+
+ Null dereference in CompositeEditCommand::cloneParagraphUnderNewElement() due to not checking for top of DOM tree
+ https://bugs.webkit.org/show_bug.cgi?id=218132
+
+ Reviewed by Ryosuke Niwa.
+
+ Add a test to verify that we don't iterate outside the DOM tree while cloning a paragraph.
+ Thanks to Ryosuke Niwa for helping minimize the test and make it more stable.
+
+ * editing/deleting/move-paragraph-crash-expected.txt: Added.
+ * editing/deleting/move-paragraph-crash.html: Added.
+
2020-10-28 Ryosuke Niwa <[email protected]>
REGRESSION(r267329): Crash in VisibleSelection::toNormalizedRange()
Added: trunk/LayoutTests/editing/deleting/move-paragraph-crash-expected.txt (0 => 269137)
--- trunk/LayoutTests/editing/deleting/move-paragraph-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/editing/deleting/move-paragraph-crash-expected.txt 2020-10-29 05:26:10 UTC (rev 269137)
@@ -0,0 +1,9 @@
+
+This tests that a crash will not occur during paragraph cloning.
+
+
+This tests that a crash will not occur during paragraph cloning.
+
+
+
+PASS
Added: trunk/LayoutTests/editing/deleting/move-paragraph-crash.html (0 => 269137)
--- trunk/LayoutTests/editing/deleting/move-paragraph-crash.html (rev 0)
+++ trunk/LayoutTests/editing/deleting/move-paragraph-crash.html 2020-10-29 05:26:10 UTC (rev 269137)
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<body contenteditable>
+<table><style id="t"></style></table>
+<output id="output"> </output><strike><img>
+<shadow></shadow>
+</strike>
+<p>This tests that a crash will not occur during paragraph cloning.</p>
+<script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+
+ document.querySelector('shadow').appendChild(document.createElementNS("http://www.w3.org/1999/xhtml", "frame"));
+ document.execCommand('selectAll');
+
+ t.setAttribute('onload', 'document.execCommand("justifyFull", false)');
+ document.execCommand("indent", false);
+ document.write('PASS');
+</script>
+</body>
+</html>
\ No newline at end of file
Modified: trunk/Source/WebCore/ChangeLog (269136 => 269137)
--- trunk/Source/WebCore/ChangeLog 2020-10-29 03:53:02 UTC (rev 269136)
+++ trunk/Source/WebCore/ChangeLog 2020-10-29 05:26:10 UTC (rev 269137)
@@ -1,3 +1,17 @@
+2020-10-28 Julian Gonzalez <[email protected]>
+
+ Null dereference in CompositeEditCommand::cloneParagraphUnderNewElement() due to not checking for top of DOM tree
+ https://bugs.webkit.org/show_bug.cgi?id=218132
+
+ Reviewed by Ryosuke Niwa.
+
+ When iterating through parent nodes, cloneParagraphUnderNewElement()
+ has to be careful to check for the top of the DOM tree (where
+ parentNode() returns nullptr) and stop iterating.
+
+ * editing/CompositeEditCommand.cpp:
+ (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement):
+
2020-10-28 Ryosuke Niwa <[email protected]>
REGRESSION(r267329): Crash in VisibleSelection::toNormalizedRange()
Modified: trunk/Source/WebCore/editing/CompositeEditCommand.cpp (269136 => 269137)
--- trunk/Source/WebCore/editing/CompositeEditCommand.cpp 2020-10-29 03:53:02 UTC (rev 269136)
+++ trunk/Source/WebCore/editing/CompositeEditCommand.cpp 2020-10-29 05:26:10 UTC (rev 269137)
@@ -1268,7 +1268,7 @@
// If end is not a descendant of outerNode we need to
// find the first common ancestor to increase the scope
// of our nextSibling traversal.
- while (!end.deprecatedNode()->isDescendantOf(outerNode.get())) {
+ while (!end.deprecatedNode()->isDescendantOf(outerNode.get()) && outerNode->parentNode()) {
outerNode = outerNode->parentNode();
}
@@ -1277,9 +1277,10 @@
// Move lastNode up in the tree as much as node was moved up in the
// tree by NodeTraversal::nextSkippingChildren, so that the relative depth between
// node and the original start node is maintained in the clone.
- while (startNode->parentNode() != node->parentNode()) {
+ while (startNode->parentNode() && startNode->parentNode() != node->parentNode()) {
startNode = startNode->parentNode();
lastNode = lastNode->parentNode();
+ ASSERT(lastNode);
}
auto clonedNode = node->cloneNode(true);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
