Changeset 276186 in webkit

Timestamp:

Apr 16, 2021, 5:57:21 PM (5 years ago)

Author:

commit-queue@webkit.org

Message:

Nullptr deref in CompositeEditCommand::isRemovableBlock in DeleteSelectionCommand::removeRedundantBlocks
​https://bugs.webkit.org/show_bug.cgi?id=224518

Patch by Ian Gilbert <​iang@apple.com> on 2021-04-16
Reviewed by Ryosuke Niwa.

Source/WebCore:

Add null check in case node is removed while iterating over tree.

Test: editing/execCommand/remove-node-during-command-crash.html

• editing/DeleteSelectionCommand.cpp:

(WebCore::DeleteSelectionCommand::removeRedundantBlocks):

LayoutTests:

Add a regression test.

• editing/execCommand/remove-node-during-command-crash-expected.txt: Added.
• editing/execCommand/remove-node-during-command-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/editing/execCommand/remove-node-during-command-crash-expected.txt (added)
• LayoutTests/editing/execCommand/remove-node-during-command-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/editing/DeleteSelectionCommand.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-04-16  Ian Gilbert  <iang@apple.com>
+
+        Nullptr deref in CompositeEditCommand::isRemovableBlock in DeleteSelectionCommand::removeRedundantBlocks
+        https://bugs.webkit.org/show_bug.cgi?id=224518
+
+        Reviewed by Ryosuke Niwa.
+
+        Add a regression test.
+
+        * editing/execCommand/remove-node-during-command-crash-expected.txt: Added.
+        * editing/execCommand/remove-node-during-command-crash.html: Added.
+
 2021-04-16  Cameron McCormack  <heycam@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-04-16  Ian Gilbert  <iang@apple.com>
+
+        Nullptr deref in CompositeEditCommand::isRemovableBlock in DeleteSelectionCommand::removeRedundantBlocks
+        https://bugs.webkit.org/show_bug.cgi?id=224518
+
+        Reviewed by Ryosuke Niwa.
+
+        Add null check in case node is removed while iterating over tree.
+
+        Test: editing/execCommand/remove-node-during-command-crash.html
+
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::removeRedundantBlocks):
+
 2021-04-16  Cameron McCormack  <heycam@apple.com>
 

trunk/Source/WebCore/editing/DeleteSelectionCommand.cpp

@@ -866 +866 @@
 void DeleteSelectionCommand::removeRedundantBlocks()
 {
-    Node* node = m_endingPosition.containerNode();
-    Node* rootNode = node->rootEditableElement();
+    auto node = makeRefPtr(m_endingPosition.containerNode());
+    auto rootNode = makeRefPtr(node->rootEditableElement());
    
-    while (node != rootNode) {
-        if (isRemovableBlock(node)) {
+    while (node && node != rootNode) {
+        if (isRemovableBlock(node.get())) {
             if (node == m_endingPosition.anchorNode())
                 updatePositionForNodeRemovalPreservingChildren(m_endingPosition, *node);