Title: [282544] releases/WebKitGTK/webkit-2.32
- Revision
- 282544
- Author
- [email protected]
- Date
- 2021-09-16 03:43:41 -0700 (Thu, 16 Sep 2021)
Log Message
Merge r279284 - Nullptr crash in StyledMarkupAccumulator::traverseNodesForSerialization
https://bugs.webkit.org/show_bug.cgi?id=226821
Reviewed by Ryosuke Niwa.
Source/WebCore:
r276394 fixed an issue in serialization when transversing the nodes. It added a new condition
to the ASSERT that was checking that its OK not to have a next pointer when there is a valid
pastEnd in the case of pastEnd being a descendant of the pointer traversing the node tree.
However that descendant check was not including the shadow DOM. This is precisely the case
detected by the test case this patch is adding.
Test: editing/selection/setSelection-shadow-dom-crash.html
* editing/markup.cpp:
(WebCore::StyledMarkupAccumulator::traverseNodesForSerialization):
LayoutTests:
* editing/selection/setSelection-shadow-dom-crash-expected.txt: Added.
* editing/selection/setSelection-shadow-dom-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.32/LayoutTests/ChangeLog (282543 => 282544)
--- releases/WebKitGTK/webkit-2.32/LayoutTests/ChangeLog 2021-09-16 10:43:34 UTC (rev 282543)
+++ releases/WebKitGTK/webkit-2.32/LayoutTests/ChangeLog 2021-09-16 10:43:41 UTC (rev 282544)
@@ -1,3 +1,13 @@
+2021-06-17 Sergio Villar Senin <[email protected]>
+
+ Nullptr crash in StyledMarkupAccumulator::traverseNodesForSerialization
+ https://bugs.webkit.org/show_bug.cgi?id=226821
+
+ Reviewed by Ryosuke Niwa.
+
+ * editing/selection/setSelection-shadow-dom-crash-expected.txt: Added.
+ * editing/selection/setSelection-shadow-dom-crash.html: Added.
+
2021-05-27 Mikhail R. Gadelha <[email protected]>
Increase NumberToStringBuffer to account for negative number
Added: releases/WebKitGTK/webkit-2.32/LayoutTests/editing/selection/setSelection-shadow-dom-crash-expected.txt (0 => 282544)
--- releases/WebKitGTK/webkit-2.32/LayoutTests/editing/selection/setSelection-shadow-dom-crash-expected.txt (rev 0)
+++ releases/WebKitGTK/webkit-2.32/LayoutTests/editing/selection/setSelection-shadow-dom-crash-expected.txt 2021-09-16 10:43:41 UTC (rev 282544)
@@ -0,0 +1,2 @@
+
+This test PASS if it does not crash.
Added: releases/WebKitGTK/webkit-2.32/LayoutTests/editing/selection/setSelection-shadow-dom-crash.html (0 => 282544)
--- releases/WebKitGTK/webkit-2.32/LayoutTests/editing/selection/setSelection-shadow-dom-crash.html (rev 0)
+++ releases/WebKitGTK/webkit-2.32/LayoutTests/editing/selection/setSelection-shadow-dom-crash.html 2021-09-16 10:43:41 UTC (rev 282544)
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<body></body>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+const image = document.createElement('img');
+document.body.appendChild(image);
+const selection = window.getSelection();
+const image2 = document.createElement('img');
+const div = document.createElement('div');
+document.body.appendChild(div);
+const shadow = div.attachShadow({
+ mode: "open",
+});
+shadow.appendChild(image2);
+if (window.internals) {
+ internals.setSelectionWithoutValidation(shadow, 0, image, 2);
+ document.execCommand("copy");
+
+ const p = document.createElement('p');
+ p.innerHTML = "This test PASS if it does not crash."
+ document.body.appendChild(p);
+}
+</script>
Modified: releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog (282543 => 282544)
--- releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog 2021-09-16 10:43:34 UTC (rev 282543)
+++ releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog 2021-09-16 10:43:41 UTC (rev 282544)
@@ -1,3 +1,22 @@
+2021-06-17 Sergio Villar Senin <[email protected]>
+
+ Nullptr crash in StyledMarkupAccumulator::traverseNodesForSerialization
+ https://bugs.webkit.org/show_bug.cgi?id=226821
+
+ Reviewed by Ryosuke Niwa.
+
+ r276394 fixed an issue in serialization when transversing the nodes. It added a new condition
+ to the ASSERT that was checking that its OK not to have a next pointer when there is a valid
+ pastEnd in the case of pastEnd being a descendant of the pointer traversing the node tree.
+
+ However that descendant check was not including the shadow DOM. This is precisely the case
+ detected by the test case this patch is adding.
+
+ Test: editing/selection/setSelection-shadow-dom-crash.html
+
+ * editing/markup.cpp:
+ (WebCore::StyledMarkupAccumulator::traverseNodesForSerialization):
+
2021-06-22 Rob Buis <[email protected]>
Make rendererIsEverNeeded check less strict
Modified: releases/WebKitGTK/webkit-2.32/Source/WebCore/editing/markup.cpp (282543 => 282544)
--- releases/WebKitGTK/webkit-2.32/Source/WebCore/editing/markup.cpp 2021-09-16 10:43:34 UTC (rev 282543)
+++ releases/WebKitGTK/webkit-2.32/Source/WebCore/editing/markup.cpp 2021-09-16 10:43:41 UTC (rev 282544)
@@ -697,7 +697,7 @@
}
}
}
- ASSERT(next || !pastEnd);
+ ASSERT(next || !pastEnd || n->containsIncludingShadowDOM(pastEnd));
if (isBlock(n) && canHaveChildrenForEditing(*n) && next == pastEnd) {
// Don't write out empty block containers that aren't fully selected.
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
