Title: [282520] releases/WebKitGTK/webkit-2.32/Source/WebCore
- Revision
- 282520
- Author
- [email protected]
- Date
- 2021-09-16 02:52:21 -0700 (Thu, 16 Sep 2021)
Log Message
Merge r277600 - REGRESSION(r277425): Crash in FrameSelection::selectFrameElementInParentIfFullySelected
https://bugs.webkit.org/show_bug.cgi?id=225795
Patch by Frederic Wang <[email protected]> on 2021-05-17
Reviewed by Ryosuke Niwa.
r277425 claimed that in FrameSelection::setSelectionWithoutUpdatingAppearance,
!m_document->frame() was equivalent to !selectionEndpointsBelongToMultipleDocuments &&
!selectionIsInAnotherDocument && selectionIsInDetachedDocument, but it misses the case when
newSelection.document() is null. So this patch adds back this particular case to the
original "if" block. This patch also adds an ASSERT on m_document->frame().
No new tests.
* editing/FrameSelection.cpp:
(WebCore::FrameSelection::setSelectionWithoutUpdatingAppearance): Add back the case
!m_document->frame() && !newSelection.document() to the first sanity check and ASSERT on
m_document->frame() after the second sanity check.
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog (282519 => 282520)
--- releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog 2021-09-16 09:40:17 UTC (rev 282519)
+++ releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog 2021-09-16 09:52:21 UTC (rev 282520)
@@ -1,3 +1,23 @@
+2021-05-17 Frederic Wang <[email protected]>
+
+ REGRESSION(r277425): Crash in FrameSelection::selectFrameElementInParentIfFullySelected
+ https://bugs.webkit.org/show_bug.cgi?id=225795
+
+ Reviewed by Ryosuke Niwa.
+
+ r277425 claimed that in FrameSelection::setSelectionWithoutUpdatingAppearance,
+ !m_document->frame() was equivalent to !selectionEndpointsBelongToMultipleDocuments &&
+ !selectionIsInAnotherDocument && selectionIsInDetachedDocument, but it misses the case when
+ newSelection.document() is null. So this patch adds back this particular case to the
+ original "if" block. This patch also adds an ASSERT on m_document->frame().
+
+ No new tests.
+
+ * editing/FrameSelection.cpp:
+ (WebCore::FrameSelection::setSelectionWithoutUpdatingAppearance): Add back the case
+ !m_document->frame() && !newSelection.document() to the first sanity check and ASSERT on
+ m_document->frame() after the second sanity check.
+
2021-05-14 Rob Buis <[email protected]>
Provide custom SetInlineFillGradient copy ctor
Modified: releases/WebKitGTK/webkit-2.32/Source/WebCore/editing/FrameSelection.cpp (282519 => 282520)
--- releases/WebKitGTK/webkit-2.32/Source/WebCore/editing/FrameSelection.cpp 2021-09-16 09:40:17 UTC (rev 282519)
+++ releases/WebKitGTK/webkit-2.32/Source/WebCore/editing/FrameSelection.cpp 2021-09-16 09:52:21 UTC (rev 282520)
@@ -363,7 +363,7 @@
return false;
}
- if (!m_document) {
+ if (!m_document || (!m_document->frame() && !newSelection.document())) {
m_selection = newSelection;
updateAssociatedLiveRange();
return false;
@@ -376,6 +376,7 @@
clear();
return false;
}
+ ASSERT(m_document->frame());
if (closeTyping)
TypingCommand::closeTyping(*m_document);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
