Changeset 276546 in webkit

Timestamp:

Apr 23, 2021, 11:11:00 PM (5 years ago)

Author:

commit-queue@webkit.org

Message:

Crash in IndentOutdentCommand::outdentParagraph attempting to move a paragraph
​https://bugs.webkit.org/show_bug.cgi?id=224909

Patch by Ian Gilbert <​iang@apple.com> on 2021-04-23
Reviewed by Ryosuke Niwa.

Added check inside IndentOutdentCommand::outdentParagraph to ensure that inserting a
HTMLBRElement was successful before attempting to move a paragraph to that node.

• editing/IndentOutdentCommand.cpp:

(WebCore::IndentOutdentCommand::outdentParagraph):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• editing/IndentOutdentCommand.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-04-23  Ian Gilbert  <iang@apple.com>
+
+        Crash in IndentOutdentCommand::outdentParagraph attempting to move a paragraph
+        https://bugs.webkit.org/show_bug.cgi?id=224909
+
+        Reviewed by Ryosuke Niwa.
+
+        Added check inside IndentOutdentCommand::outdentParagraph to ensure that inserting a 
+        HTMLBRElement was successful before attempting to move a paragraph to that node.
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::outdentParagraph):
+
 2021-04-23  Ryosuke Niwa  <rniwa@webkit.org>
 

trunk/Source/WebCore/editing/IndentOutdentCommand.cpp

@@ -192 +192 @@
     }
     auto placeholder = HTMLBRElement::create(document());
-    auto* placeholderPtr = placeholder.ptr();
-    insertNodeBefore(WTFMove(placeholder), *splitBlockquoteNode);
-    moveParagraph(startOfParagraph(visibleStartOfParagraph), endOfParagraph(visibleEndOfParagraph), positionBeforeNode(placeholderPtr), true);
+    insertNodeBefore(placeholder, *splitBlockquoteNode);
+    if (placeholder->isConnected())
+        moveParagraph(startOfParagraph(visibleStartOfParagraph), endOfParagraph(visibleEndOfParagraph), positionBeforeNode(placeholder.ptr()), true);
 }