Changeset 275994 in webkit

Timestamp:

Apr 14, 2021, 8:27:10 PM (6 years ago)

Author:

rniwa@webkit.org

Message:

Crash in in ReplaceSelectionCommand::mergeEndIfNeeded()
​https://bugs.webkit.org/show_bug.cgi?id=222941

Unreviewed. Address Darin's post-commit comment that we don't need to explicitly call copyRef here.

• editing/ReplaceSelectionCommand.cpp:

(WebCore::ReplaceSelectionCommand::mergeEndIfNeeded):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• editing/ReplaceSelectionCommand.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-04-14  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Crash in in ReplaceSelectionCommand::mergeEndIfNeeded()
+        https://bugs.webkit.org/show_bug.cgi?id=222941
+
+        Unreviewed. Address Darin's post-commit comment that we don't need to explicitly call copyRef here.
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::mergeEndIfNeeded):
+
 2021-04-14  Wenson Hsieh  <wenson_hsieh@apple.com>
 

trunk/Source/WebCore/editing/ReplaceSelectionCommand.cpp

@@ -995 +995 @@
     if (endOfParagraph(startOfParagraphToMove) == destination) {
         auto placeholder = HTMLBRElement::create(document());
-        insertNodeBefore(placeholder.copyRef(), *startOfParagraphToMove.deepEquivalent().deprecatedNode());
+        insertNodeBefore(placeholder, *startOfParagraphToMove.deepEquivalent().deprecatedNode());
         destination = VisiblePosition(positionBeforeNode(placeholder.ptr()));
     }