Changeset 278593 in webkit

Timestamp:

Jun 8, 2021, 12:35:58 AM (5 years ago)

Author:

commit-queue@webkit.org

Message:

Crash in InsertParagraphSeparatorCommand::doApply
​https://bugs.webkit.org/show_bug.cgi?id=226527

Patch by Frédéric Wang <​fwang@igalia.com> on 2021-06-08
Reviewed by Ryosuke Niwa.

Source/WebCore:

After r273375 and r278002, it is possible that InsertParagraphSeparatorCommand::doApply is
confused by a display: table start block, leading to nullptr crash in the rest of the
function. This patch just excludes that case in order to work around that kind of issue.

Test: fast/editing/insert-paragraph-with-img-in-table-crash.html

• editing/InsertParagraphSeparatorCommand.cpp:

(WebCore::InsertParagraphSeparatorCommand::doApply):

LayoutTests:

Add regression test.

• fast/editing/insert-paragraph-with-img-in-table-crash-expected.txt: Added.
• fast/editing/insert-paragraph-with-img-in-table-crash.html: Added. Note that not having a

new line at the end of the HTML file is required to make the test crash without the patch.

• fast/editing/insert-paragraph-with-text-in-table-crash-expected.txt: Added.
• fast/editing/insert-paragraph-with-text-in-table-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/editing/insert-paragraph-with-img-in-table-crash-expected.txt (added)
• LayoutTests/fast/editing/insert-paragraph-with-img-in-table-crash.html (added)
• LayoutTests/fast/editing/insert-paragraph-with-text-in-table-crash-expected.txt (added)
• LayoutTests/fast/editing/insert-paragraph-with-text-in-table-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/editing/InsertParagraphSeparatorCommand.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-06-08  Frédéric Wang  <fwang@igalia.com>
+
+        Crash in InsertParagraphSeparatorCommand::doApply
+        https://bugs.webkit.org/show_bug.cgi?id=226527
+
+        Reviewed by Ryosuke Niwa.
+
+        Add regression test.
+
+        * fast/editing/insert-paragraph-with-img-in-table-crash-expected.txt: Added.
+        * fast/editing/insert-paragraph-with-img-in-table-crash.html: Added. Note that not having a
+        new line at the end of the HTML file is required to make the test crash without the patch.
+        * fast/editing/insert-paragraph-with-text-in-table-crash-expected.txt: Added.
+        * fast/editing/insert-paragraph-with-text-in-table-crash.html: Added.
+
+
 2021-06-07  Alexey Shvayka  <shvaikalesh@gmail.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-06-08  Frédéric Wang  <fwang@igalia.com>
+
+        Crash in InsertParagraphSeparatorCommand::doApply
+        https://bugs.webkit.org/show_bug.cgi?id=226527
+
+        Reviewed by Ryosuke Niwa.
+
+        After r273375 and r278002, it is possible that InsertParagraphSeparatorCommand::doApply is
+        confused by a display: table start block, leading to nullptr crash in the rest of the
+        function. This patch just excludes that case in order to work around that kind of issue.
+
+        Test: fast/editing/insert-paragraph-with-img-in-table-crash.html
+
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
+
 2021-06-07  Alex Christensen  <achristensen@webkit.org>
 

trunk/Source/WebCore/editing/InsertParagraphSeparatorCommand.cpp

@@ -167 +167 @@
     if (!startBlock
         || !startBlock->nonShadowBoundaryParentNode()
+        || isRenderedTable(startBlock.get())
         || isTableCell(startBlock.get())
         || is<HTMLFormElement>(*startBlock)