Title: [158719] trunk/Source/WebCore
- Revision
- 158719
- Author
- [email protected]
- Date
- 2013-11-05 21:21:42 -0800 (Tue, 05 Nov 2013)
Log Message
Protect DOM nodes in IndentOutdentCommand::tryIndentingAsListItem()
https://bugs.webkit.org/show_bug.cgi?id=123861
Reviewed by Benjamin Poulain.
Merge https://chromium.googlesource.com/chromium/blink/+/297442eb539a2b764fdad323de79099a70179186 partially.
* editing/IndentOutdentCommand.cpp:
(WebCore::IndentOutdentCommand::tryIndentingAsListItem): Make selectedListItem, previousList, and nextList
RefPtr since they're are used after calling insertNodeBefore.
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (158718 => 158719)
--- trunk/Source/WebCore/ChangeLog 2013-11-06 04:47:12 UTC (rev 158718)
+++ trunk/Source/WebCore/ChangeLog 2013-11-06 05:21:42 UTC (rev 158719)
@@ -1,3 +1,16 @@
+2013-11-05 Ryosuke Niwa <[email protected]>
+
+ Protect DOM nodes in IndentOutdentCommand::tryIndentingAsListItem()
+ https://bugs.webkit.org/show_bug.cgi?id=123861
+
+ Reviewed by Benjamin Poulain.
+
+ Merge https://chromium.googlesource.com/chromium/blink/+/297442eb539a2b764fdad323de79099a70179186 partially.
+
+ * editing/IndentOutdentCommand.cpp:
+ (WebCore::IndentOutdentCommand::tryIndentingAsListItem): Make selectedListItem, previousList, and nextList
+ RefPtr since they're are used after calling insertNodeBefore.
+
2013-11-05 Andreas Kling <[email protected]>
Apply more unique_ptr to line box management.
Modified: trunk/Source/WebCore/editing/IndentOutdentCommand.cpp (158718 => 158719)
--- trunk/Source/WebCore/editing/IndentOutdentCommand.cpp 2013-11-06 04:47:12 UTC (rev 158718)
+++ trunk/Source/WebCore/editing/IndentOutdentCommand.cpp 2013-11-06 05:21:42 UTC (rev 158719)
@@ -64,24 +64,24 @@
return false;
// Find the block that we want to indent. If it's not a list item (e.g., a div inside a list item), we bail out.
- Element* selectedListItem = enclosingBlock(lastNodeInSelectedParagraph);
+ RefPtr<Element> selectedListItem = enclosingBlock(lastNodeInSelectedParagraph);
// FIXME: we need to deal with the case where there is no li (malformed HTML)
if (!selectedListItem->hasTagName(liTag))
return false;
// FIXME: previousElementSibling does not ignore non-rendered content like <span></span>. Should we?
- Element* previousList = ElementTraversal::previousSibling(selectedListItem);
- Element* nextList = ElementTraversal::nextSibling(selectedListItem);
+ RefPtr<Element> previousList = ElementTraversal::previousSibling(selectedListItem.get());
+ RefPtr<Element> nextList = ElementTraversal::nextSibling(selectedListItem.get());
RefPtr<Element> newList = document().createElement(listNode->tagQName(), false);
insertNodeBefore(newList, selectedListItem);
- moveParagraphWithClones(start, end, newList.get(), selectedListItem);
+ moveParagraphWithClones(start, end, newList.get(), selectedListItem.get());
- if (canMergeLists(previousList, newList.get()))
+ if (canMergeLists(previousList.get(), newList.get()))
mergeIdenticalElements(previousList, newList);
- if (canMergeLists(newList.get(), nextList))
+ if (canMergeLists(newList.get(), nextList.get()))
mergeIdenticalElements(newList, nextList);
return true;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
