Changeset 273375 in webkit

Timestamp:

Feb 24, 2021, 1:20:30 AM (6 years ago)

Author:

commit-queue@webkit.org

Message:

Nullptr crash in CompositeEditCommand::splitTreeToNode via InsertParagraphSeparatorCommand::doApply
​https://bugs.webkit.org/show_bug.cgi?id=221387

Patch by Frederic Wang <​fwang@igalia.com> on 2021-02-24
Reviewed by Ryosuke Niwa.

Source/WebCore:

WebCore::Position::upstream behaves specially for table renderer, which may confuse the
execution of WebCore::InsertParagraphSeparatorCommand::doApply() when the visible position
is within a table, leading to a debug assertion failure and a nullptr dereference in release
build. This patch fixes that by forcing createFragmentFromText to convert <table> to new
a default paragraph element.

Test: fast/editing/paste-and-match-style-with-table-crash.html

• editing/markup.cpp:

(WebCore::createFragmentFromText): Don't clone enclosing block that are <table>.

LayoutTests:

• fast/editing/paste-and-match-style-with-table-crash-expected.txt: Added.
• fast/editing/paste-and-match-style-with-table-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/editing/paste-and-match-style-with-table-crash-expected.txt (added)
• LayoutTests/fast/editing/paste-and-match-style-with-table-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/editing/markup.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-02-24  Frederic Wang  <fwang@igalia.com>
+
+        Nullptr crash in CompositeEditCommand::splitTreeToNode via InsertParagraphSeparatorCommand::doApply
+        https://bugs.webkit.org/show_bug.cgi?id=221387
+
+        Reviewed by Ryosuke Niwa.
+
+        * fast/editing/paste-and-match-style-with-table-crash-expected.txt: Added.
+        * fast/editing/paste-and-match-style-with-table-crash.html: Added.
+
 2021-02-24  Carlos Garcia Campos  <cgarcia@igalia.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-02-24  Frederic Wang  <fwang@igalia.com>
+
+        Nullptr crash in CompositeEditCommand::splitTreeToNode via InsertParagraphSeparatorCommand::doApply
+        https://bugs.webkit.org/show_bug.cgi?id=221387
+
+        Reviewed by Ryosuke Niwa.
+
+        WebCore::Position::upstream behaves specially for table renderer, which may confuse the
+        execution of WebCore::InsertParagraphSeparatorCommand::doApply() when the visible position
+        is within a table, leading to a debug assertion failure and a nullptr dereference in release
+        build. This patch fixes that by forcing createFragmentFromText to convert <table> to new
+        a default paragraph element.
+
+        Test: fast/editing/paste-and-match-style-with-table-crash.html
+
+        * editing/markup.cpp:
+        (WebCore::createFragmentFromText): Don't clone enclosing block that are <table>.
+
 2021-02-24  Carlos Garcia Campos  <cgarcia@igalia.com>
 

trunk/Source/WebCore/editing/markup.cpp

@@ -1200 +1200 @@
         && !block->hasTagName(bodyTag)
         && !block->hasTagName(htmlTag)
+        // Avoid using table as paragraphs due to its special treatment in Position::upstream/downstream.
+        && !block->hasTagName(tableTag)
         && block != editableRootForPosition(start);
     bool useLineBreak = enclosingTextFormControl(start);