Title: [280896] releases/WebKitGTK/webkit-2.32/Source/WebCore
- Revision
- 280896
- Author
- [email protected]
- Date
- 2021-08-11 03:19:36 -0700 (Wed, 11 Aug 2021)
Log Message
Merge r274626 - ASSERTION FAILED: node.isConnected() in matchSlottedPseudoElementRules
https://bugs.webkit.org/show_bug.cgi?id=221440
Patch by Frédéric Wang <[email protected]> on 2021-03-18
Reviewed by Ryosuke Niwa.
ReplaceSelectionCommand::doApply() removes a <br> from an element and immediately calls
highestNodeToRemoveInPruning() on that element. The former operation may destroy the
element's renderer and confuses the latter operation. This happens in particular for a
<summary> element which ends up being removed from the tree. This in turn causes unexpected
issues such as a debug assertion failure in matchSlottedPseudoElementRules. To address that
problem, ensure the document is laid out before calling highestNodeToRemoveInPruning().
This patch also increases and improves use of RefPtr<Node>.
* editing/CompositeEditCommand.cpp:
(WebCore::CompositeEditCommand::removeNodeAndPruneAncestors): Use auto & makeRefPtr.
(WebCore::CompositeEditCommand::prune): Store local highestNodeToRemove variable in a RefPtr.
(WebCore::CompositeEditCommand::cleanupAfterDeletion): Store local node variable in a RefPtr.
(WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph): Store local parentNode variable in a RefPtr.
* editing/Editing.cpp:
(WebCore::highestNodeToRemoveInPruning): Store local currentNode variable in a a RefPtr.
* editing/ReplaceSelectionCommand.cpp:
(WebCore::ReplaceSelectionCommand::doApply): Use auto & makeRefPtr. Store local odeToRemove variable in a RefPtr.
Ensure the document is laid out before calling highestNodeToRemoveInPruning.
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog (280895 => 280896)
--- releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog 2021-08-11 10:16:12 UTC (rev 280895)
+++ releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog 2021-08-11 10:19:36 UTC (rev 280896)
@@ -1,3 +1,29 @@
+2021-03-18 Frédéric Wang <[email protected]>
+
+ ASSERTION FAILED: node.isConnected() in matchSlottedPseudoElementRules
+ https://bugs.webkit.org/show_bug.cgi?id=221440
+
+ Reviewed by Ryosuke Niwa.
+
+ ReplaceSelectionCommand::doApply() removes a <br> from an element and immediately calls
+ highestNodeToRemoveInPruning() on that element. The former operation may destroy the
+ element's renderer and confuses the latter operation. This happens in particular for a
+ <summary> element which ends up being removed from the tree. This in turn causes unexpected
+ issues such as a debug assertion failure in matchSlottedPseudoElementRules. To address that
+ problem, ensure the document is laid out before calling highestNodeToRemoveInPruning().
+ This patch also increases and improves use of RefPtr<Node>.
+
+ * editing/CompositeEditCommand.cpp:
+ (WebCore::CompositeEditCommand::removeNodeAndPruneAncestors): Use auto & makeRefPtr.
+ (WebCore::CompositeEditCommand::prune): Store local highestNodeToRemove variable in a RefPtr.
+ (WebCore::CompositeEditCommand::cleanupAfterDeletion): Store local node variable in a RefPtr.
+ (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph): Store local parentNode variable in a RefPtr.
+ * editing/Editing.cpp:
+ (WebCore::highestNodeToRemoveInPruning): Store local currentNode variable in a a RefPtr.
+ * editing/ReplaceSelectionCommand.cpp:
+ (WebCore::ReplaceSelectionCommand::doApply): Use auto & makeRefPtr. Store local odeToRemove variable in a RefPtr.
+ Ensure the document is laid out before calling highestNodeToRemoveInPruning.
+
2021-03-15 Zalan Bujtas <[email protected]>
Do not collapse the anonymous block when it is a candidate container for the list marker
Modified: releases/WebKitGTK/webkit-2.32/Source/WebCore/editing/CompositeEditCommand.cpp (280895 => 280896)
--- releases/WebKitGTK/webkit-2.32/Source/WebCore/editing/CompositeEditCommand.cpp 2021-08-11 10:16:12 UTC (rev 280895)
+++ releases/WebKitGTK/webkit-2.32/Source/WebCore/editing/CompositeEditCommand.cpp 2021-08-11 10:19:36 UTC (rev 280896)
@@ -612,7 +612,7 @@
void CompositeEditCommand::removeNodeAndPruneAncestors(Node& node)
{
- RefPtr<ContainerNode> parent = node.parentNode();
+ auto parent = makeRefPtr(node.parentNode());
removeNode(node);
prune(parent.get());
}
@@ -656,7 +656,7 @@
void CompositeEditCommand::prune(Node* node)
{
- if (auto* highestNodeToRemove = highestNodeToRemoveInPruning(node))
+ if (auto highestNodeToRemove = makeRefPtr(highestNodeToRemoveInPruning(node)))
removeNode(*highestNodeToRemove);
}
@@ -1293,7 +1293,7 @@
if (!caretAfterDelete.equals(destination) && isStartOfParagraph(caretAfterDelete) && isEndOfParagraph(caretAfterDelete)) {
// Note: We want the rightmost candidate.
Position position = caretAfterDelete.deepEquivalent().downstream();
- Node* node = position.deprecatedNode();
+ auto node = makeRefPtr(position.deprecatedNode());
ASSERT(node);
// Normally deletion will leave a br as a placeholder.
if (is<HTMLBRElement>(*node))
@@ -1302,11 +1302,11 @@
// doesn't require a placeholder to prop itself open (like a bordered
// div or an li), remove it during the move (the list removal code
// expects this behavior).
- else if (isBlock(node)) {
+ else if (isBlock(node.get())) {
// If caret position after deletion and destination position coincides,
// node should not be removed.
if (!position.rendersInDifferentPosition(destination.deepEquivalent())) {
- prune(node);
+ prune(node.get());
return;
}
removeNodeAndPruneAncestors(*node);
@@ -1623,11 +1623,11 @@
else if (is<Text>(*caretPos.deprecatedNode())) {
ASSERT(caretPos.deprecatedEditingOffset() == 0);
Text& textNode = downcast<Text>(*caretPos.deprecatedNode());
- ContainerNode* parentNode = textNode.parentNode();
+ auto parentNode = makeRefPtr(textNode.parentNode());
// The preserved newline must be the first thing in the node, since otherwise the previous
// paragraph would be quoted, and we verified that it wasn't above.
deleteTextFromNode(textNode, 0, 1);
- prune(parentNode);
+ prune(parentNode.get());
}
return true;
Modified: releases/WebKitGTK/webkit-2.32/Source/WebCore/editing/Editing.cpp (280895 => 280896)
--- releases/WebKitGTK/webkit-2.32/Source/WebCore/editing/Editing.cpp 2021-08-11 10:16:12 UTC (rev 280895)
+++ releases/WebKitGTK/webkit-2.32/Source/WebCore/editing/Editing.cpp 2021-08-11 10:19:36 UTC (rev 280896)
@@ -628,12 +628,12 @@
{
Node* previousNode = nullptr;
auto* rootEditableElement = node ? node->rootEditableElement() : nullptr;
- for (; node; node = node->parentNode()) {
- if (auto* renderer = node->renderer()) {
- if (!renderer->canHaveChildren() || hasARenderedDescendant(node, previousNode) || rootEditableElement == node)
+ for (auto currentNode = makeRefPtr(node); currentNode; currentNode = currentNode->parentNode()) {
+ if (auto* renderer = currentNode->renderer()) {
+ if (!renderer->canHaveChildren() || hasARenderedDescendant(currentNode.get(), previousNode) || rootEditableElement == currentNode.get())
return previousNode;
}
- previousNode = node;
+ previousNode = currentNode.get();
}
return nullptr;
}
Modified: releases/WebKitGTK/webkit-2.32/Source/WebCore/editing/ReplaceSelectionCommand.cpp (280895 => 280896)
--- releases/WebKitGTK/webkit-2.32/Source/WebCore/editing/ReplaceSelectionCommand.cpp 2021-08-11 10:16:12 UTC (rev 280895)
+++ releases/WebKitGTK/webkit-2.32/Source/WebCore/editing/ReplaceSelectionCommand.cpp 2021-08-11 10:19:36 UTC (rev 280896)
@@ -1297,11 +1297,12 @@
insertNodeAt(HTMLBRElement::create(document()), startOfInsertedContent.deepEquivalent());
if (endBR && (plainTextFragment || shouldRemoveEndBR(endBR.get(), originalVisPosBeforeEndBR))) {
- RefPtr<Node> parent = endBR->parentNode();
+ auto parent = makeRefPtr(endBR->parentNode());
insertedNodes.willRemoveNode(endBR.get());
removeNode(*endBR);
- if (Node* nodeToRemove = highestNodeToRemoveInPruning(parent.get())) {
- insertedNodes.willRemoveNode(nodeToRemove);
+ document().updateLayoutIgnorePendingStylesheets();
+ if (auto nodeToRemove = makeRefPtr(highestNodeToRemoveInPruning(parent.get()))) {
+ insertedNodes.willRemoveNode(nodeToRemove.get());
removeNode(*nodeToRemove);
}
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
