Changeset 278002 in webkit

Timestamp:

May 25, 2021, 1:32:20 AM (5 years ago)

Author:

commit-queue@webkit.org

Message:

Crash in CompositeEditCommand::splitTreeToNode via InsertParagraphSeparatorCommand::doApply
​https://bugs.webkit.org/show_bug.cgi?id=225267

Patch by Frederic Wang <​fwang@igalia.com> on 2021-05-25
Reviewed by Ryosuke Niwa.

Source/WebCore:

WebCore::Position::upstream behaves specially for table renderer, which may confuse the
execution of WebCore::InsertParagraphSeparatorCommand::doApply() when the visible position
is within a table, leading to a debug assertion failure and a nullptr dereference in release
build. In r273375, this was fixed for DOM elements with the table tag, but this does not work
for display: table. This patch instead directly calls isRenderedTable, for consistency with
WebCore::Position::upstream.

Test: fast/editing/paste-and-match-style-with-table-2-crash.html

• editing/markup.cpp:

(WebCore::createFragmentFromText): Use isRenderedTable instead of checking the tag name.

LayoutTests:

Add regression test.

• fast/editing/paste-and-match-style-with-table-2-crash-expected.txt: Added.
• fast/editing/paste-and-match-style-with-table-2-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/editing/paste-and-match-style-with-table-2-crash-expected.txt (added)
• LayoutTests/fast/editing/paste-and-match-style-with-table-2-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/editing/markup.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-05-25  Frederic Wang  <fwang@igalia.com>
+
+        Crash in CompositeEditCommand::splitTreeToNode via InsertParagraphSeparatorCommand::doApply
+        https://bugs.webkit.org/show_bug.cgi?id=225267
+
+        Reviewed by Ryosuke Niwa.
+
+        Add regression test.
+
+        * fast/editing/paste-and-match-style-with-table-2-crash-expected.txt: Added.
+        * fast/editing/paste-and-match-style-with-table-2-crash.html: Added.
+
 2021-05-25  Fujii Hironori  <Hironori.Fujii@sony.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-05-25  Frederic Wang  <fwang@igalia.com>
+
+        Crash in CompositeEditCommand::splitTreeToNode via InsertParagraphSeparatorCommand::doApply
+        https://bugs.webkit.org/show_bug.cgi?id=225267
+
+        Reviewed by Ryosuke Niwa.
+
+        WebCore::Position::upstream behaves specially for table renderer, which may confuse the
+        execution of WebCore::InsertParagraphSeparatorCommand::doApply() when the visible position
+        is within a table, leading to a debug assertion failure and a nullptr dereference in release
+        build. In r273375, this was fixed for DOM elements with the table tag, but this does not work
+        for display: table. This patch instead directly calls isRenderedTable, for consistency with
+        WebCore::Position::upstream.
+
+        Test: fast/editing/paste-and-match-style-with-table-2-crash.html
+
+        * editing/markup.cpp:
+        (WebCore::createFragmentFromText): Use isRenderedTable instead of checking the tag name.
+
 2021-05-25  Ian Gilbert  <iang@apple.com>
 

trunk/Source/WebCore/editing/markup.cpp

@@ -1204 +1204 @@
         && !block->hasTagName(htmlTag)
         // Avoid using table as paragraphs due to its special treatment in Position::upstream/downstream.
-        && !block->hasTagName(tableTag)
+        && !isRenderedTable(block)
         && block != editableRootForPosition(start);
     bool useLineBreak = enclosingTextFormControl(start);