Changeset 269778 in webkit

Timestamp:

Nov 13, 2020, 8:04:15 AM (6 years ago)

Author:

commit-queue@webkit.org

Message:

Crash in ReplaceSelectionCommand::moveNodeOutOfAncestor
​https://bugs.webkit.org/show_bug.cgi?id=218878

Patch by Julian Gonzalez <​julian_a_gonzalez@apple.com> on 2020-11-13
Reviewed by Alex Christensen.

Source/WebCore:

Add a missing null check inside moveNodeOutOfAncestor, as splitTreeToNode()
can return nullptr.

Test: editing/execCommand/crash-deleting-after-inserting-text-horizontal-rule.html

• editing/ReplaceSelectionCommand.cpp:

(WebCore::ReplaceSelectionCommand::moveNodeOutOfAncestor):

LayoutTests:

Add simple test that selects elements, and using execCommand() inserts text
and a horizontal rule, and performs a deletion.

• editing/execCommand/crash-deleting-after-inserting-text-horizontal-rule-expected.txt: Added.
• editing/execCommand/crash-deleting-after-inserting-text-horizontal-rule.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/editing/execCommand/crash-deleting-after-inserting-text-horizontal-rule-expected.txt (added)
• LayoutTests/editing/execCommand/crash-deleting-after-inserting-text-horizontal-rule.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/editing/ReplaceSelectionCommand.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2020-11-13  Julian Gonzalez  <julian_a_gonzalez@apple.com>
+
+        Crash in ReplaceSelectionCommand::moveNodeOutOfAncestor
+        https://bugs.webkit.org/show_bug.cgi?id=218878
+
+        Reviewed by Alex Christensen.
+
+        Add simple test that selects elements, and using execCommand() inserts text
+        and a horizontal rule, and performs a deletion.
+
+        * editing/execCommand/crash-deleting-after-inserting-text-horizontal-rule-expected.txt: Added.
+        * editing/execCommand/crash-deleting-after-inserting-text-horizontal-rule.html: Added.
+
 2020-11-13  Rob Buis  <rbuis@igalia.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2020-11-13  Julian Gonzalez  <julian_a_gonzalez@apple.com>
+
+        Crash in ReplaceSelectionCommand::moveNodeOutOfAncestor
+        https://bugs.webkit.org/show_bug.cgi?id=218878
+
+        Reviewed by Alex Christensen.
+
+        Add a missing null check inside moveNodeOutOfAncestor, as splitTreeToNode()
+        can return nullptr.
+
+        Test: editing/execCommand/crash-deleting-after-inserting-text-horizontal-rule.html
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::moveNodeOutOfAncestor):
+
 2020-11-13  Rob Buis  <rbuis@igalia.com>
 

trunk/Source/WebCore/editing/ReplaceSelectionCommand.cpp

@@ -801 +801 @@
         RefPtr<Node> nodeToSplitTo = splitTreeToNode(node, ancestor, true);
         removeNode(node);
-        insertNodeBefore(WTFMove(protectedNode), *nodeToSplitTo);
+        if (nodeToSplitTo)
+            insertNodeBefore(WTFMove(protectedNode), *nodeToSplitTo);
     }