Title: [275253] trunk
- Revision
- 275253
- Author
- [email protected]
- Date
- 2021-03-30 18:35:55 -0700 (Tue, 30 Mar 2021)
Log Message
Nullptr crash in Crash in WebCore::positionInParentBeforeNode(..) where a NULL check is missing.
https://bugs.webkit.org/show_bug.cgi?id=223639
Patch by Venky Dass <[email protected]> on 2021-03-30
Reviewed by Ryosuke Niwa.
Source/WebCore:
In positionInParentBeforeNode(..) there is a null check missing on a pointer - hence the crash.
Test: LayoutTests/editing/inserting/edit-style-and-insert-image.html
* editing/ReplaceSelectionCommand.cpp:
(WebCore::ReplaceSelectionCommand::doApply):
LayoutTests:
Adding a regression test case.
* editing/inserting/edit-style-and-insert-image-expected.txt: Added.
* editing/inserting/edit-style-and-insert-image.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (275252 => 275253)
--- trunk/LayoutTests/ChangeLog 2021-03-31 01:19:31 UTC (rev 275252)
+++ trunk/LayoutTests/ChangeLog 2021-03-31 01:35:55 UTC (rev 275253)
@@ -1,3 +1,15 @@
+2021-03-30 Venky Dass <[email protected]>
+
+ Nullptr crash in Crash in WebCore::positionInParentBeforeNode(..) where a NULL check is missing.
+ https://bugs.webkit.org/show_bug.cgi?id=223639
+
+ Reviewed by Ryosuke Niwa.
+
+ Adding a regression test case.
+
+ * editing/inserting/edit-style-and-insert-image-expected.txt: Added.
+ * editing/inserting/edit-style-and-insert-image.html: Added.
+
2021-03-30 Robert Jenner <[email protected]>
[ macOS Debug ] imported/w3c/web-platform-tests/xhr/xhr-timeout-longtask.any.worker.html is a flakey text failure
Added: trunk/LayoutTests/editing/inserting/edit-style-and-insert-image-expected.txt (0 => 275253)
--- trunk/LayoutTests/editing/inserting/edit-style-and-insert-image-expected.txt (rev 0)
+++ trunk/LayoutTests/editing/inserting/edit-style-and-insert-image-expected.txt 2021-03-31 01:35:55 UTC (rev 275253)
@@ -0,0 +1 @@
+
Added: trunk/LayoutTests/editing/inserting/edit-style-and-insert-image.html (0 => 275253)
--- trunk/LayoutTests/editing/inserting/edit-style-and-insert-image.html (rev 0)
+++ trunk/LayoutTests/editing/inserting/edit-style-and-insert-image.html 2021-03-31 01:35:55 UTC (rev 275253)
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<body contenteditable>
+<p>This tests Pass.</p>
+<blockquote type="cite"><input></blockquote>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+getSelection().setPosition(document.querySelector('input'), 1);
+document.documentElement.style = 'content: url();'
+document.execCommand('InsertImage');
+</script>
+This tests InsertImage after setting content property on the document element.<br>
+WebKit should not crash.<br>
+<br>
+PASS
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (275252 => 275253)
--- trunk/Source/WebCore/ChangeLog 2021-03-31 01:19:31 UTC (rev 275252)
+++ trunk/Source/WebCore/ChangeLog 2021-03-31 01:35:55 UTC (rev 275253)
@@ -1,3 +1,17 @@
+2021-03-30 Venky Dass <[email protected]>
+
+ Nullptr crash in Crash in WebCore::positionInParentBeforeNode(..) where a NULL check is missing.
+ https://bugs.webkit.org/show_bug.cgi?id=223639
+
+ Reviewed by Ryosuke Niwa.
+
+ In positionInParentBeforeNode(..) there is a null check missing on a pointer - hence the crash.
+
+ Test: LayoutTests/editing/inserting/edit-style-and-insert-image.html
+
+ * editing/ReplaceSelectionCommand.cpp:
+ (WebCore::ReplaceSelectionCommand::doApply):
+
2021-03-30 Ryosuke Niwa <[email protected]>
Occasional debug assert in GenericTaskQueue::~GenericTaskQueue
Modified: trunk/Source/WebCore/editing/ReplaceSelectionCommand.cpp (275252 => 275253)
--- trunk/Source/WebCore/editing/ReplaceSelectionCommand.cpp 2021-03-31 01:19:31 UTC (rev 275252)
+++ trunk/Source/WebCore/editing/ReplaceSelectionCommand.cpp 2021-03-31 01:35:55 UTC (rev 275253)
@@ -1139,12 +1139,12 @@
// breaking the blockquote will prevent the content from actually being inserted in the table.
if (shouldHandleMailBlockquote && m_preventNesting && !(enclosingNodeOfType(insertionPos, &isTableStructureNode))) {
applyCommandToComposite(BreakBlockquoteCommand::create(document()));
- // This will leave a br between the split.
- Node* br = endingSelection().start().deprecatedNode();
- ASSERT(br->hasTagName(brTag));
- // Insert content between the two blockquotes, but remove the br (since it was just a placeholder).
- insertionPos = positionInParentBeforeNode(br);
- removeNode(*br);
+ // This will leave a br between the split.
+ if (auto br = makeRefPtr(endingSelection().start().deprecatedNode())) {
+ ASSERT(br->hasTagName(brTag));
+ insertionPos = positionInParentBeforeNode(br.get());
+ removeNode(*br);
+ }
}
// Inserting content could cause whitespace to collapse, e.g. inserting <div>foo</div> into hello^ world.
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
