Title: [269778] trunk
- Revision
- 269778
- Author
- [email protected]
- Date
- 2020-11-13 08:04:15 -0800 (Fri, 13 Nov 2020)
Log Message
Crash in ReplaceSelectionCommand::moveNodeOutOfAncestor
https://bugs.webkit.org/show_bug.cgi?id=218878
Patch by Julian Gonzalez <[email protected]> on 2020-11-13
Reviewed by Alex Christensen.
Source/WebCore:
Add a missing null check inside moveNodeOutOfAncestor, as splitTreeToNode()
can return nullptr.
Test: editing/execCommand/crash-deleting-after-inserting-text-horizontal-rule.html
* editing/ReplaceSelectionCommand.cpp:
(WebCore::ReplaceSelectionCommand::moveNodeOutOfAncestor):
LayoutTests:
Add simple test that selects elements, and using execCommand() inserts text
and a horizontal rule, and performs a deletion.
* editing/execCommand/crash-deleting-after-inserting-text-horizontal-rule-expected.txt: Added.
* editing/execCommand/crash-deleting-after-inserting-text-horizontal-rule.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (269777 => 269778)
--- trunk/LayoutTests/ChangeLog 2020-11-13 16:01:05 UTC (rev 269777)
+++ trunk/LayoutTests/ChangeLog 2020-11-13 16:04:15 UTC (rev 269778)
@@ -1,3 +1,16 @@
+2020-11-13 Julian Gonzalez <[email protected]>
+
+ Crash in ReplaceSelectionCommand::moveNodeOutOfAncestor
+ https://bugs.webkit.org/show_bug.cgi?id=218878
+
+ Reviewed by Alex Christensen.
+
+ Add simple test that selects elements, and using execCommand() inserts text
+ and a horizontal rule, and performs a deletion.
+
+ * editing/execCommand/crash-deleting-after-inserting-text-horizontal-rule-expected.txt: Added.
+ * editing/execCommand/crash-deleting-after-inserting-text-horizontal-rule.html: Added.
+
2020-11-13 Rob Buis <[email protected]>
Null check anchorNode of endingSelection start
Added: trunk/LayoutTests/editing/execCommand/crash-deleting-after-inserting-text-horizontal-rule-expected.txt (0 => 269778)
--- trunk/LayoutTests/editing/execCommand/crash-deleting-after-inserting-text-horizontal-rule-expected.txt (rev 0)
+++ trunk/LayoutTests/editing/execCommand/crash-deleting-after-inserting-text-horizontal-rule-expected.txt 2020-11-13 16:04:15 UTC (rev 269778)
@@ -0,0 +1,5 @@
+This tests that we do not crash while deleting the selection.
+
+PASS
+
+
Added: trunk/LayoutTests/editing/execCommand/crash-deleting-after-inserting-text-horizontal-rule.html (0 => 269778)
--- trunk/LayoutTests/editing/execCommand/crash-deleting-after-inserting-text-horizontal-rule.html (rev 0)
+++ trunk/LayoutTests/editing/execCommand/crash-deleting-after-inserting-text-horizontal-rule.html 2020-11-13 16:04:15 UTC (rev 269778)
@@ -0,0 +1,28 @@
+<html>
+<head>
+<script>
+function testonload() {
+ if (window.testRunner)
+ testRunner.dumpAsText();
+
+ document.getSelection().selectAllChildren(pre);
+ document.execCommand("insertText", false, "PASS");
+ document.execCommand("insertHorizontalRule", false);
+}
+function iframehandler() {
+ document.execCommand("forwardDelete", false);
+}
+</script>
+</head>
+<body _onload_=testonload()>
+This tests that we do not crash while deleting the selection.
+<details open="true" contenteditable="true">
+<p>
+<iframe _onload_="iframehandler()"></iframe>
+<table>
+<pre id="pre"></pre>
+</table>
+</p>
+</details>
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (269777 => 269778)
--- trunk/Source/WebCore/ChangeLog 2020-11-13 16:01:05 UTC (rev 269777)
+++ trunk/Source/WebCore/ChangeLog 2020-11-13 16:04:15 UTC (rev 269778)
@@ -1,3 +1,18 @@
+2020-11-13 Julian Gonzalez <[email protected]>
+
+ Crash in ReplaceSelectionCommand::moveNodeOutOfAncestor
+ https://bugs.webkit.org/show_bug.cgi?id=218878
+
+ Reviewed by Alex Christensen.
+
+ Add a missing null check inside moveNodeOutOfAncestor, as splitTreeToNode()
+ can return nullptr.
+
+ Test: editing/execCommand/crash-deleting-after-inserting-text-horizontal-rule.html
+
+ * editing/ReplaceSelectionCommand.cpp:
+ (WebCore::ReplaceSelectionCommand::moveNodeOutOfAncestor):
+
2020-11-13 Rob Buis <[email protected]>
Null check anchorNode of endingSelection start
Modified: trunk/Source/WebCore/editing/ReplaceSelectionCommand.cpp (269777 => 269778)
--- trunk/Source/WebCore/editing/ReplaceSelectionCommand.cpp 2020-11-13 16:01:05 UTC (rev 269777)
+++ trunk/Source/WebCore/editing/ReplaceSelectionCommand.cpp 2020-11-13 16:04:15 UTC (rev 269778)
@@ -800,7 +800,8 @@
} else {
RefPtr<Node> nodeToSplitTo = splitTreeToNode(node, ancestor, true);
removeNode(node);
- insertNodeBefore(WTFMove(protectedNode), *nodeToSplitTo);
+ if (nodeToSplitTo)
+ insertNodeBefore(WTFMove(protectedNode), *nodeToSplitTo);
}
document().updateLayoutIgnorePendingStylesheets();
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
