Changeset 274849 in webkit

Timestamp:

Mar 22, 2021, 11:23:57 PM (5 years ago)

Author:

commit-queue@webkit.org

Message:

Nullptr crash in WebCore::RenderObject::RenderObjectBitfields::isLineBreak() where a NULL check is missing.
​https://bugs.webkit.org/show_bug.cgi?id=223409

Patch by Venky Dass <​yaranamavenkataramana@apple.com> on 2021-03-22
Reviewed by Ryosuke Niwa.

Source/WebCore:

When the check for LineBreak is performed the BR elmement NULL check is not performed. Which results in a crash
The fix therefore is to check for NULL.

Test: LayoutTests/editing/inserting/insert-paragraph-between-hr-and-br-assigned-to-slot-crash.html

• editing/InsertParagraphSeparatorCommand.cpp:

(WebCore::InsertParagraphSeparatorCommand::doApply):

LayoutTests:

Adding a regression test case.

• editing/inserting/insert-paragraph-between-hr-and-br-assigned-to-slot-crash-expected.txt: Added.
• editing/inserting/insert-paragraph-between-hr-and-br-assigned-to-slot-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/editing/inserting/insert-paragraph-between-hr-and-br-assigned-to-slot-crash-expected.txt (added)
• LayoutTests/editing/inserting/insert-paragraph-between-hr-and-br-assigned-to-slot-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/editing/InsertParagraphSeparatorCommand.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-03-22  Venky Dass  <yaranamavenkataramana@apple.com>
+
+        Nullptr crash in  WebCore::RenderObject::RenderObjectBitfields::isLineBreak() where a NULL check is missing.
+        https://bugs.webkit.org/show_bug.cgi?id=223409
+
+        Reviewed by Ryosuke Niwa.
+
+        Adding a regression test case.
+        
+        * editing/inserting/insert-paragraph-between-hr-and-br-assigned-to-slot-crash-expected.txt: Added.
+        * editing/inserting/insert-paragraph-between-hr-and-br-assigned-to-slot-crash.html: Added.
+
 2021-03-22  Julian Gonzalez  <julian_a_gonzalez@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-03-22  Venky Dass  <yaranamavenkataramana@apple.com>
+
+        Nullptr crash in  WebCore::RenderObject::RenderObjectBitfields::isLineBreak() where a NULL check is missing.
+        https://bugs.webkit.org/show_bug.cgi?id=223409
+
+        Reviewed by Ryosuke Niwa.
+
+        When the check for LineBreak is performed the BR elmement NULL check is not performed. Which results in a crash
+        The fix therefore is to check for NULL.
+        
+        Test: LayoutTests/editing/inserting/insert-paragraph-between-hr-and-br-assigned-to-slot-crash.html
+
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
+
 2021-03-22  Julian Gonzalez  <julian_a_gonzalez@apple.com>
 

trunk/Source/WebCore/editing/InsertParagraphSeparatorCommand.cpp

@@ -314 +314 @@
         // If the insertion point is a break element, there is nothing else
         // we need to do.
-        if (visiblePos.deepEquivalent().anchorNode()->renderer()->isBR()) {
+        if (auto* renderer = visiblePos.deepEquivalent().anchorNode()->renderer(); renderer && renderer->isBR()) {
             setEndingSelection(VisibleSelection(insertionPosition, Affinity::Downstream, endingSelection().isDirectional()));
             return;