Title: [269776] trunk
- Revision
- 269776
- Author
- [email protected]
- Date
- 2020-11-13 08:00:41 -0800 (Fri, 13 Nov 2020)
Log Message
Null check anchorNode of endingSelection start
https://bugs.webkit.org/show_bug.cgi?id=218492
Patch by Rob Buis <[email protected]> on 2020-11-13
Reviewed by Alex Christensen.
Source/WebCore:
Null check anchorNode of endingSelection start.
Test: editing/deleting/delete-contenteditable-crash.html
* editing/DeleteSelectionCommand.cpp:
(WebCore::DeleteSelectionCommand::mergeParagraphs):
LayoutTests:
Add testcase.
* editing/deleting/delete-contenteditable-crash-expected.txt: Added.
* editing/deleting/delete-contenteditable-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (269775 => 269776)
--- trunk/LayoutTests/ChangeLog 2020-11-13 15:30:59 UTC (rev 269775)
+++ trunk/LayoutTests/ChangeLog 2020-11-13 16:00:41 UTC (rev 269776)
@@ -1,3 +1,15 @@
+2020-11-13 Rob Buis <[email protected]>
+
+ Null check anchorNode of endingSelection start
+ https://bugs.webkit.org/show_bug.cgi?id=218492
+
+ Reviewed by Alex Christensen.
+
+ Add testcase.
+
+ * editing/deleting/delete-contenteditable-crash-expected.txt: Added.
+ * editing/deleting/delete-contenteditable-crash.html: Added.
+
2020-11-13 Miguel Gomez <[email protected]>
[GTK][WPE] CSS backdrop overlay corners are not rounded on results.webkit.org
Added: trunk/LayoutTests/editing/deleting/delete-contenteditable-crash-expected.txt (0 => 269776)
--- trunk/LayoutTests/editing/deleting/delete-contenteditable-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/editing/deleting/delete-contenteditable-crash-expected.txt 2020-11-13 16:00:41 UTC (rev 269776)
@@ -0,0 +1 @@
+Test passes if no crashes with asan.
Added: trunk/LayoutTests/editing/deleting/delete-contenteditable-crash.html (0 => 269776)
--- trunk/LayoutTests/editing/deleting/delete-contenteditable-crash.html (rev 0)
+++ trunk/LayoutTests/editing/deleting/delete-contenteditable-crash.html 2020-11-13 16:00:41 UTC (rev 269776)
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function runTest()
+{
+ if (window.testRunner)
+ testRunner.dumpAsText();
+
+ getSelection().setBaseAndExtent(span, 0, span, 2);
+ document.execCommand("delete", false);
+ document.write("Test passes if no crashes with asan.")
+}
+
+</script>
+</head>
+<body _onload_="runTest()">
+<li contenteditable="">
+ <basefont>
+ <progress contenteditable="false">
+ <span id="span">content</span>
+ </progress>
+</li>
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (269775 => 269776)
--- trunk/Source/WebCore/ChangeLog 2020-11-13 15:30:59 UTC (rev 269775)
+++ trunk/Source/WebCore/ChangeLog 2020-11-13 16:00:41 UTC (rev 269776)
@@ -1,3 +1,17 @@
+2020-11-13 Rob Buis <[email protected]>
+
+ Null check anchorNode of endingSelection start
+ https://bugs.webkit.org/show_bug.cgi?id=218492
+
+ Reviewed by Alex Christensen.
+
+ Null check anchorNode of endingSelection start.
+
+ Test: editing/deleting/delete-contenteditable-crash.html
+
+ * editing/DeleteSelectionCommand.cpp:
+ (WebCore::DeleteSelectionCommand::mergeParagraphs):
+
2020-11-13 Aditya Keerthi <[email protected]>
[iOS][FCR] Add an internal feature flag to enable the new appearance
Modified: trunk/Source/WebCore/editing/DeleteSelectionCommand.cpp (269775 => 269776)
--- trunk/Source/WebCore/editing/DeleteSelectionCommand.cpp 2020-11-13 15:30:59 UTC (rev 269775)
+++ trunk/Source/WebCore/editing/DeleteSelectionCommand.cpp 2020-11-13 16:00:41 UTC (rev 269776)
@@ -761,7 +761,7 @@
// The endingPosition was likely clobbered by the move, so recompute it (moveParagraph selects the moved paragraph).
// FIXME (Bug 211793): endingSelection() becomes disconnected in moveParagraph
- if (endingSelection().start().anchorNode()->isConnected())
+ if (auto* anchorNode = endingSelection().start().anchorNode(); anchorNode && anchorNode->isConnected())
m_endingPosition = endingSelection().start();
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
