Title: [285813] trunk
- Revision
- 285813
- Author
- [email protected]
- Date
- 2021-11-15 10:56:59 -0800 (Mon, 15 Nov 2021)
Log Message
nullptr deref in CompositeEditCommand::insertNodeAt
https://bugs.webkit.org/show_bug.cgi?id=232837
Patch by Gabriel Nava Marino <[email protected]> on 2021-11-15
Reviewed by Wenson Hsieh and Darin Adler.
Source/WebCore:
Check endingSelection is not orphan before inserting nodes at
the start position.
Test: fast/editing/editing-position-crash.html
* editing/CreateLinkCommand.cpp:
(WebCore::CreateLinkCommand::doApply):
LayoutTests:
* fast/editing/editing-position-crash-expected.txt: Added.
* fast/editing/editing-position-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (285812 => 285813)
--- trunk/LayoutTests/ChangeLog 2021-11-15 18:49:06 UTC (rev 285812)
+++ trunk/LayoutTests/ChangeLog 2021-11-15 18:56:59 UTC (rev 285813)
@@ -1,3 +1,13 @@
+2021-11-15 Gabriel Nava Marino <[email protected]>
+
+ nullptr deref in CompositeEditCommand::insertNodeAt
+ https://bugs.webkit.org/show_bug.cgi?id=232837
+
+ Reviewed by Wenson Hsieh and Darin Adler.
+
+ * fast/editing/editing-position-crash-expected.txt: Added.
+ * fast/editing/editing-position-crash.html: Added.
+
2021-11-15 Tyler Wilcock <[email protected]>
AX: Un-skip accessibility/mac/search-predicate-for-adhoc-radio-groups.html for Mac WK1
Added: trunk/LayoutTests/fast/editing/editing-position-crash-expected.txt (0 => 285813)
--- trunk/LayoutTests/fast/editing/editing-position-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/editing/editing-position-crash-expected.txt 2021-11-15 18:56:59 UTC (rev 285813)
@@ -0,0 +1,3 @@
+
+PASS if this doesn't crash
+
Added: trunk/LayoutTests/fast/editing/editing-position-crash.html (0 => 285813)
--- trunk/LayoutTests/fast/editing/editing-position-crash.html (rev 0)
+++ trunk/LayoutTests/fast/editing/editing-position-crash.html 2021-11-15 18:56:59 UTC (rev 285813)
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+_onload_ = () => {
+ document.designMode = "on";
+ path0 = document.getElementById('path0');
+ path0.focus();
+ if (window.testRunner)
+ testRunner.dumpAsText();
+}
+function insert() {
+ document.execCommand("insertHorizontalRule", false, null);
+ window.addEventListener("beforeinput", delfn, { capture: true, once: true });
+ document.execCommand("createLink", false, "x");
+}
+function delfn() {
+ document.execCommand("delete", false, null);
+}
+</script>
+</head>
+<body>
+<svg _onfocusin_="insert()">
+<path id="path0" tabindex="2" _onfocusin_="window.getSelection().setPosition(obj0, 10);" />
+</svg>
+<br />
+<object id="obj0" data="" type="image/jpeg">
+PASS if this doesn't crash
+</object>
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (285812 => 285813)
--- trunk/Source/WebCore/ChangeLog 2021-11-15 18:49:06 UTC (rev 285812)
+++ trunk/Source/WebCore/ChangeLog 2021-11-15 18:56:59 UTC (rev 285813)
@@ -1,3 +1,18 @@
+2021-11-15 Gabriel Nava Marino <[email protected]>
+
+ nullptr deref in CompositeEditCommand::insertNodeAt
+ https://bugs.webkit.org/show_bug.cgi?id=232837
+
+ Reviewed by Wenson Hsieh and Darin Adler.
+
+ Check endingSelection is not orphan before inserting nodes at
+ the start position.
+
+ Test: fast/editing/editing-position-crash.html
+
+ * editing/CreateLinkCommand.cpp:
+ (WebCore::CreateLinkCommand::doApply):
+
2021-11-15 Andreu Botella <[email protected]>
Null bytes aren't percent-encoded on urlencoded over POST
Modified: trunk/Source/WebCore/editing/CreateLinkCommand.cpp (285812 => 285813)
--- trunk/Source/WebCore/editing/CreateLinkCommand.cpp 2021-11-15 18:49:06 UTC (rev 285812)
+++ trunk/Source/WebCore/editing/CreateLinkCommand.cpp 2021-11-15 18:56:59 UTC (rev 285813)
@@ -40,9 +40,9 @@
void CreateLinkCommand::doApply()
{
- if (endingSelection().isNone())
+ if (endingSelection().isNoneOrOrphaned())
return;
-
+
auto anchorElement = HTMLAnchorElement::create(document());
anchorElement->setHref(m_url);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
