Changeset 274131 in webkit

Timestamp:

Mar 8, 2021, 7:41:33 PM (5 years ago)

Author:

commit-queue@webkit.org

Message:

Crash in in ReplaceSelectionCommand::mergeEndIfNeeded()
​https://bugs.webkit.org/show_bug.cgi?id=222941

Patch by Julian Gonzalez <​julian_a_gonzalez@apple.com> on 2021-03-08
Reviewed by Ryosuke Niwa.

Make a copy of Ref<HTMLBRElement> when inserting before start of paragraph.

• editing/ReplaceSelectionCommand.cpp:

(WebCore::ReplaceSelectionCommand::mergeEndIfNeeded):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• editing/ReplaceSelectionCommand.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-03-08  Julian Gonzalez  <julian_a_gonzalez@apple.com>
+
+        Crash in in ReplaceSelectionCommand::mergeEndIfNeeded()
+        https://bugs.webkit.org/show_bug.cgi?id=222941
+
+        Reviewed by Ryosuke Niwa.
+
+        Make a copy of Ref<HTMLBRElement> when inserting before start of paragraph.
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::mergeEndIfNeeded):
+
 2021-03-08  Jean-Yves Avenard  <jya@apple.com>
 

trunk/Source/WebCore/editing/ReplaceSelectionCommand.cpp

@@ -968 +968 @@
     if (endOfParagraph(startOfParagraphToMove) == destination) {
         auto placeholder = HTMLBRElement::create(document());
-        auto* placeholderPtr = placeholder.ptr();
-        insertNodeBefore(WTFMove(placeholder), *startOfParagraphToMove.deepEquivalent().deprecatedNode());
-        destination = VisiblePosition(positionBeforeNode(placeholderPtr));
+        insertNodeBefore(placeholder.copyRef(), *startOfParagraphToMove.deepEquivalent().deprecatedNode());
+        destination = VisiblePosition(positionBeforeNode(placeholder.ptr()));
     }