Title: [285920] trunk
- Revision
- 285920
- Author
- [email protected]
- Date
- 2021-11-17 01:18:30 -0800 (Wed, 17 Nov 2021)
Log Message
Null check clonedParent
https://bugs.webkit.org/show_bug.cgi?id=230713
Patch by Rob Buis <[email protected]> on 2021-11-17
Reviewed by Wenson Hsieh.
Source/WebCore:
Null check clonedParent.
Test: editing/execCommand/insert-newline-in-quoted-content-crash.html
* editing/BreakBlockquoteCommand.cpp:
(WebCore::BreakBlockquoteCommand::doApply):
LayoutTests:
* editing/execCommand/insert-newline-in-quoted-content-crash-expected.txt: Added.
* editing/execCommand/insert-newline-in-quoted-content-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (285919 => 285920)
--- trunk/LayoutTests/ChangeLog 2021-11-17 08:53:02 UTC (rev 285919)
+++ trunk/LayoutTests/ChangeLog 2021-11-17 09:18:30 UTC (rev 285920)
@@ -1,3 +1,13 @@
+2021-11-17 Rob Buis <[email protected]>
+
+ Null check clonedParent
+ https://bugs.webkit.org/show_bug.cgi?id=230713
+
+ Reviewed by Wenson Hsieh.
+
+ * editing/execCommand/insert-newline-in-quoted-content-crash-expected.txt: Added.
+ * editing/execCommand/insert-newline-in-quoted-content-crash.html: Added.
+
2021-11-16 Rob Buis <[email protected]>
Re-add 'style' to contain:strict and contain:content CSS properties
Added: trunk/LayoutTests/editing/execCommand/insert-newline-in-quoted-content-crash-expected.txt (0 => 285920)
--- trunk/LayoutTests/editing/execCommand/insert-newline-in-quoted-content-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/editing/execCommand/insert-newline-in-quoted-content-crash-expected.txt 2021-11-17 09:18:30 UTC (rev 285920)
@@ -0,0 +1 @@
+Test passes if it does not crash.
Added: trunk/LayoutTests/editing/execCommand/insert-newline-in-quoted-content-crash.html (0 => 285920)
--- trunk/LayoutTests/editing/execCommand/insert-newline-in-quoted-content-crash.html (rev 0)
+++ trunk/LayoutTests/editing/execCommand/insert-newline-in-quoted-content-crash.html 2021-11-17 09:18:30 UTC (rev 285920)
@@ -0,0 +1,27 @@
+<script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+ _onload_ = async () => {
+ visualViewport._onresize_ = () => {
+ document.execCommand('InsertNewlineInQuotedContent');
+ document.write("Test passes if it does not crash.");
+ };
+ document.body.appendChild(document.createElement('object'));
+ document.body.appendChild(document.createElement('div'));
+ document.body.appendChild(document.createElement('iframe'));
+ document.execCommand('SelectAll');
+ document.designMode = 'on';
+ document.execCommand('Copy');
+ document.createElement('img').src = '';
+ let animation = new Animation();
+ animation.play();
+ await animation.ready;
+ document.execCommand('Paste');
+ document.execCommand('PasteAsQuotation');
+ getSelection().modify('move', 'left', 'character');
+ document.execCommand('InsertUnorderedList');
+ await new Blob().arrayBuffer();
+ document.execCommand('SelectAll');
+ document.execCommand('InsertUnorderedList');
+ };
+</script>
Modified: trunk/Source/WebCore/ChangeLog (285919 => 285920)
--- trunk/Source/WebCore/ChangeLog 2021-11-17 08:53:02 UTC (rev 285919)
+++ trunk/Source/WebCore/ChangeLog 2021-11-17 09:18:30 UTC (rev 285920)
@@ -1,3 +1,17 @@
+2021-11-17 Rob Buis <[email protected]>
+
+ Null check clonedParent
+ https://bugs.webkit.org/show_bug.cgi?id=230713
+
+ Reviewed by Wenson Hsieh.
+
+ Null check clonedParent.
+
+ Test: editing/execCommand/insert-newline-in-quoted-content-crash.html
+
+ * editing/BreakBlockquoteCommand.cpp:
+ (WebCore::BreakBlockquoteCommand::doApply):
+
2021-11-16 Rob Buis <[email protected]>
Re-add 'style' to contain:strict and contain:content CSS properties
Modified: trunk/Source/WebCore/editing/BreakBlockquoteCommand.cpp (285919 => 285920)
--- trunk/Source/WebCore/editing/BreakBlockquoteCommand.cpp 2021-11-17 08:53:02 UTC (rev 285919)
+++ trunk/Source/WebCore/editing/BreakBlockquoteCommand.cpp 2021-11-17 09:18:30 UTC (rev 285920)
@@ -168,9 +168,12 @@
RefPtr<Element> ancestor;
RefPtr<Element> clonedParent;
for (ancestor = ancestors.first(), clonedParent = clonedAncestor->parentElement();
- ancestor && ancestor != topBlockquote;
- ancestor = ancestor->parentElement(), clonedParent = clonedParent->parentElement())
+ ancestor && ancestor != topBlockquote;
+ ancestor = ancestor->parentElement(), clonedParent = clonedParent->parentElement()) {
+ if (!clonedParent)
+ break;
moveRemainingSiblingsToNewParent(ancestor->nextSibling(), 0, *clonedParent);
+ }
// If the startNode's original parent is now empty, remove it
Node* originalParent = ancestors.first().get();
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
