Changeset 259619 in webkit

Timestamp:

Apr 6, 2020, 6:45:56 PM (6 years ago)

Author:

Jack Lee

Message:

Nullptr crash in WebCore::lastPositionInNode when indenting text node that has user-select:all parent.
​https://bugs.webkit.org/show_bug.cgi?id=210016
<rdar://problem/61014577>

Reviewed by Ryosuke Niwa.

Source/WebCore:

In rangeForParagraphSplittingTextNodesIfNeeded, added null check for previousSibling()
after splitTextNode is called, and returns empty positions to caller.

In formatSelection, check the returned positions from rangeForParagraphSplittingTextNodesIfNeeded
and stop indenting the rest of the paragraphs.

Test: fast/editing/indent-pre-user-select-all-crash.html

• editing/ApplyBlockElementCommand.cpp:

(WebCore::ApplyBlockElementCommand::formatSelection):
(WebCore::ApplyBlockElementCommand::rangeForParagraphSplittingTextNodesIfNeeded):

LayoutTests:

Added a regression test for the crash.

• fast/editing/indent-pre-user-select-all-crash-expected.txt: Added.
• fast/editing/indent-pre-user-select-all-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/editing/indent-pre-user-select-all-crash-expected.txt (added)
• LayoutTests/fast/editing/indent-pre-user-select-all-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/editing/ApplyBlockElementCommand.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2020-04-06  Jack Lee  <shihchieh_lee@apple.com>
+
+        Nullptr crash in WebCore::lastPositionInNode when indenting text node that has user-select:all parent.
+        https://bugs.webkit.org/show_bug.cgi?id=210016
+        <rdar://problem/61014577>
+
+        Reviewed by Ryosuke Niwa.
+
+        Added a regression test for the crash.
+
+        * fast/editing/indent-pre-user-select-all-crash-expected.txt: Added.
+        * fast/editing/indent-pre-user-select-all-crash.html: Added.
+
 2020-04-06  Jason Lawrence  <lawrence.j@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2020-04-06  Jack Lee  <shihchieh_lee@apple.com>
+
+        Nullptr crash in WebCore::lastPositionInNode when indenting text node that has user-select:all parent.
+        https://bugs.webkit.org/show_bug.cgi?id=210016
+        <rdar://problem/61014577>
+
+        Reviewed by Ryosuke Niwa.
+
+        In rangeForParagraphSplittingTextNodesIfNeeded, added null check for previousSibling()
+        after splitTextNode is called, and returns empty positions to caller.
+
+        In formatSelection, check the returned positions from rangeForParagraphSplittingTextNodesIfNeeded
+        and stop indenting the rest of the paragraphs.
+
+        Test: fast/editing/indent-pre-user-select-all-crash.html
+
+        * editing/ApplyBlockElementCommand.cpp:
+        (WebCore::ApplyBlockElementCommand::formatSelection):
+        (WebCore::ApplyBlockElementCommand::rangeForParagraphSplittingTextNodesIfNeeded):
+
 2020-04-06  Devin Rousso  <drousso@apple.com>
 

trunk/Source/WebCore/editing/ApplyBlockElementCommand.cpp

@@ -134 +134 @@
 
         rangeForParagraphSplittingTextNodesIfNeeded(endOfCurrentParagraph, start, end);
+        if (start.isNull() || end.isNull())
+            break;
+
         endOfCurrentParagraph = end;
 
@@ -242 +245 @@
             RefPtr<Text> endContainer = end.containerText();
             splitTextNode(*endContainer, end.offsetInContainerNode());
+            if (is<Text>(endContainer) && !endContainer->previousSibling()) {
+                start = { };
+                end = { };
+                return;
+            }
             if (isStartAndEndOnSameNode)
                 start = firstPositionInOrBeforeNode(endContainer->previousSibling());