Title: [280833] releases/WebKitGTK/webkit-2.32/Source/WebCore
- Revision
- 280833
- Author
- [email protected]
- Date
- 2021-08-10 02:27:19 -0700 (Tue, 10 Aug 2021)
Log Message
Merge r274131 - Crash in in ReplaceSelectionCommand::mergeEndIfNeeded()
https://bugs.webkit.org/show_bug.cgi?id=222941
Patch by Julian Gonzalez <[email protected]> on 2021-03-08
Reviewed by Ryosuke Niwa.
Make a copy of Ref<HTMLBRElement> when inserting before start of paragraph.
* editing/ReplaceSelectionCommand.cpp:
(WebCore::ReplaceSelectionCommand::mergeEndIfNeeded):
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog (280832 => 280833)
--- releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog 2021-08-10 09:22:53 UTC (rev 280832)
+++ releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog 2021-08-10 09:27:19 UTC (rev 280833)
@@ -1,3 +1,15 @@
+2021-03-08 Julian Gonzalez <[email protected]>
+
+ Crash in in ReplaceSelectionCommand::mergeEndIfNeeded()
+ https://bugs.webkit.org/show_bug.cgi?id=222941
+
+ Reviewed by Ryosuke Niwa.
+
+ Make a copy of Ref<HTMLBRElement> when inserting before start of paragraph.
+
+ * editing/ReplaceSelectionCommand.cpp:
+ (WebCore::ReplaceSelectionCommand::mergeEndIfNeeded):
+
2021-03-08 Carlos Garcia Campos <[email protected]>
REGRESSION(r272900): Nullptr crash in ComposedTreeIterator::traverseNextInShadowTree() via ShadowRoot::hostChildElementDidChange
Modified: releases/WebKitGTK/webkit-2.32/Source/WebCore/editing/ReplaceSelectionCommand.cpp (280832 => 280833)
--- releases/WebKitGTK/webkit-2.32/Source/WebCore/editing/ReplaceSelectionCommand.cpp 2021-08-10 09:22:53 UTC (rev 280832)
+++ releases/WebKitGTK/webkit-2.32/Source/WebCore/editing/ReplaceSelectionCommand.cpp 2021-08-10 09:27:19 UTC (rev 280833)
@@ -967,9 +967,8 @@
// To avoid this, we add a placeholder node before the start of the paragraph.
if (endOfParagraph(startOfParagraphToMove) == destination) {
auto placeholder = HTMLBRElement::create(document());
- auto* placeholderPtr = placeholder.ptr();
- insertNodeBefore(WTFMove(placeholder), *startOfParagraphToMove.deepEquivalent().deprecatedNode());
- destination = VisiblePosition(positionBeforeNode(placeholderPtr));
+ insertNodeBefore(placeholder.copyRef(), *startOfParagraphToMove.deepEquivalent().deprecatedNode());
+ destination = VisiblePosition(positionBeforeNode(placeholder.ptr()));
}
moveParagraph(startOfParagraphToMove, endOfParagraph(startOfParagraphToMove), destination);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
