Title: [280903] releases/WebKitGTK/webkit-2.32
- Revision
- 280903
- Author
- [email protected]
- Date
- 2021-08-11 03:50:40 -0700 (Wed, 11 Aug 2021)
Log Message
Merge r274849 - Nullptr crash in WebCore::RenderObject::RenderObjectBitfields::isLineBreak() where a NULL check is missing.
https://bugs.webkit.org/show_bug.cgi?id=223409
Patch by Venky Dass <[email protected]> on 2021-03-22
Reviewed by Ryosuke Niwa.
Source/WebCore:
When the check for LineBreak is performed the BR elmement NULL check is not performed. Which results in a crash
The fix therefore is to check for NULL.
Test: LayoutTests/editing/inserting/insert-paragraph-between-hr-and-br-assigned-to-slot-crash.html
* editing/InsertParagraphSeparatorCommand.cpp:
(WebCore::InsertParagraphSeparatorCommand::doApply):
LayoutTests:
Adding a regression test case.
* editing/inserting/insert-paragraph-between-hr-and-br-assigned-to-slot-crash-expected.txt: Added.
* editing/inserting/insert-paragraph-between-hr-and-br-assigned-to-slot-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.32/LayoutTests/ChangeLog (280902 => 280903)
--- releases/WebKitGTK/webkit-2.32/LayoutTests/ChangeLog 2021-08-11 10:50:31 UTC (rev 280902)
+++ releases/WebKitGTK/webkit-2.32/LayoutTests/ChangeLog 2021-08-11 10:50:40 UTC (rev 280903)
@@ -1,3 +1,15 @@
+2021-03-22 Venky Dass <[email protected]>
+
+ Nullptr crash in WebCore::RenderObject::RenderObjectBitfields::isLineBreak() where a NULL check is missing.
+ https://bugs.webkit.org/show_bug.cgi?id=223409
+
+ Reviewed by Ryosuke Niwa.
+
+ Adding a regression test case.
+
+ * editing/inserting/insert-paragraph-between-hr-and-br-assigned-to-slot-crash-expected.txt: Added.
+ * editing/inserting/insert-paragraph-between-hr-and-br-assigned-to-slot-crash.html: Added.
+
2021-03-08 Carlos Garcia Campos <[email protected]>
REGRESSION(r272900): Nullptr crash in ComposedTreeIterator::traverseNextInShadowTree() via ShadowRoot::hostChildElementDidChange
Added: releases/WebKitGTK/webkit-2.32/LayoutTests/editing/inserting/insert-paragraph-between-hr-and-br-assigned-to-slot-crash-expected.txt (0 => 280903)
--- releases/WebKitGTK/webkit-2.32/LayoutTests/editing/inserting/insert-paragraph-between-hr-and-br-assigned-to-slot-crash-expected.txt (rev 0)
+++ releases/WebKitGTK/webkit-2.32/LayoutTests/editing/inserting/insert-paragraph-between-hr-and-br-assigned-to-slot-crash-expected.txt 2021-08-11 10:50:40 UTC (rev 280903)
@@ -0,0 +1,4 @@
+
+
+
+This tests inserting a paragraph between hr and br assigned to a slot. WebKit should not hit any assertions or crash.
Added: releases/WebKitGTK/webkit-2.32/LayoutTests/editing/inserting/insert-paragraph-between-hr-and-br-assigned-to-slot-crash.html (0 => 280903)
--- releases/WebKitGTK/webkit-2.32/LayoutTests/editing/inserting/insert-paragraph-between-hr-and-br-assigned-to-slot-crash.html (rev 0)
+++ releases/WebKitGTK/webkit-2.32/LayoutTests/editing/inserting/insert-paragraph-between-hr-and-br-assigned-to-slot-crash.html 2021-08-11 10:50:40 UTC (rev 280903)
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div id="editor" contenteditable><div id="host"><hr><br><br></div></div>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+host.attachShadow({mode: 'closed'}).innerHTML = '<slot></slot>';
+editor.focus();
+getSelection().setPosition(document.querySelector('br'), 0);
+document.execCommand('InsertParagraph');
+</script>
+</body>
+<p>This tests inserting a paragraph between hr and br assigned to a slot. WebKit should not hit any assertions or crash.</p>
+</html>
Modified: releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog (280902 => 280903)
--- releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog 2021-08-11 10:50:31 UTC (rev 280902)
+++ releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog 2021-08-11 10:50:40 UTC (rev 280903)
@@ -1,3 +1,18 @@
+2021-03-22 Venky Dass <[email protected]>
+
+ Nullptr crash in WebCore::RenderObject::RenderObjectBitfields::isLineBreak() where a NULL check is missing.
+ https://bugs.webkit.org/show_bug.cgi?id=223409
+
+ Reviewed by Ryosuke Niwa.
+
+ When the check for LineBreak is performed the BR elmement NULL check is not performed. Which results in a crash
+ The fix therefore is to check for NULL.
+
+ Test: LayoutTests/editing/inserting/insert-paragraph-between-hr-and-br-assigned-to-slot-crash.html
+
+ * editing/InsertParagraphSeparatorCommand.cpp:
+ (WebCore::InsertParagraphSeparatorCommand::doApply):
+
2021-03-22 Ian Gilbert <[email protected]>
[Web Animations] nullptr crash in updatePlaybackRate() with no timeline
Modified: releases/WebKitGTK/webkit-2.32/Source/WebCore/editing/InsertParagraphSeparatorCommand.cpp (280902 => 280903)
--- releases/WebKitGTK/webkit-2.32/Source/WebCore/editing/InsertParagraphSeparatorCommand.cpp 2021-08-11 10:50:31 UTC (rev 280902)
+++ releases/WebKitGTK/webkit-2.32/Source/WebCore/editing/InsertParagraphSeparatorCommand.cpp 2021-08-11 10:50:40 UTC (rev 280903)
@@ -313,7 +313,7 @@
insertionPosition = positionInParentAfterNode(br.ptr());
// If the insertion point is a break element, there is nothing else
// we need to do.
- if (visiblePos.deepEquivalent().anchorNode()->renderer()->isBR()) {
+ if (auto* renderer = visiblePos.deepEquivalent().anchorNode()->renderer(); renderer && renderer->isBR()) {
setEndingSelection(VisibleSelection(insertionPosition, Affinity::Downstream, endingSelection().isDirectional()));
return;
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
