Changeset 280381 in webkit

Timestamp:

Jul 28, 2021, 7:01:53 AM (5 years ago)

Author:

commit-queue@webkit.org

Message:

Crash in ApplyStyleCommand::applyRelativeFontStyleChange
​https://bugs.webkit.org/show_bug.cgi?id=226926

Patch by Frédéric Wang <​fwang@igalia.com> on 2021-07-28
Reviewed by Ryosuke Niwa.

Source/WebCore:

In r179944 and r180050, special handling was added for display: grid/flex nodes in
Position::isCandidate in order to make them editable but the same logic was not added in
PositionIterator::isCandidate. This patch fixes that inconsistency as well as the
corresponding debug ASSERT and release nullptr dereference.

Tests: fast/editing/apply-relative-font-style-change-crash-001.html

fast/editing/apply-relative-font-style-change-crash-002.html

• dom/PositionIterator.cpp:

(WebCore::PositionIterator::isCandidate const): Handle flexbox and grid.

LayoutTests:

Add regression tests.

• fast/editing/apply-relative-font-style-change-crash-001-expected.txt: Added.
• fast/editing/apply-relative-font-style-change-crash-001-expected.txt: Added.
• fast/editing/apply-relative-font-style-change-crash-002.html: Added.
• fast/editing/apply-relative-font-style-change-crash-002.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/editing/apply-relative-font-style-change-crash-001-expected.txt (added)
• LayoutTests/fast/editing/apply-relative-font-style-change-crash-001.html (added)
• LayoutTests/fast/editing/apply-relative-font-style-change-crash-002-expected.txt (added)
• LayoutTests/fast/editing/apply-relative-font-style-change-crash-002.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/dom/PositionIterator.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-07-28  Frédéric Wang  <fwang@igalia.com>
+
+        Crash in ApplyStyleCommand::applyRelativeFontStyleChange
+        https://bugs.webkit.org/show_bug.cgi?id=226926
+
+        Reviewed by Ryosuke Niwa.
+
+        Add regression tests.
+
+        * fast/editing/apply-relative-font-style-change-crash-001-expected.txt: Added.
+        * fast/editing/apply-relative-font-style-change-crash-001-expected.txt: Added.
+        * fast/editing/apply-relative-font-style-change-crash-002.html: Added.
+        * fast/editing/apply-relative-font-style-change-crash-002.html: Added.
+
 2021-07-28  Fujii Hironori  <Hironori.Fujii@sony.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-07-28  Frédéric Wang  <fwang@igalia.com>
+
+        Crash in ApplyStyleCommand::applyRelativeFontStyleChange
+        https://bugs.webkit.org/show_bug.cgi?id=226926
+
+        Reviewed by Ryosuke Niwa.
+
+        In r179944 and r180050, special handling was added for display: grid/flex nodes in
+        Position::isCandidate in order to make them editable but the same logic was not added in
+        PositionIterator::isCandidate. This patch fixes that inconsistency as well as the
+        corresponding debug ASSERT and release nullptr dereference.
+
+        Tests: fast/editing/apply-relative-font-style-change-crash-001.html
+               fast/editing/apply-relative-font-style-change-crash-002.html
+
+        * dom/PositionIterator.cpp:
+        (WebCore::PositionIterator::isCandidate const): Handle flexbox and grid.
+
 2021-07-27  Joonghun Park  <jh718.park@samsung.com>
 

trunk/Source/WebCore/dom/PositionIterator.cpp

@@ -33 +33 @@
 #include "HTMLNames.h"
 #include "RenderBlockFlow.h"
+#include "RenderFlexibleBox.h"
+#include "RenderGrid.h"
 #include "RenderText.h"
 
@@ -165 +167 @@
         return (atStartOfNode() || atEndOfNode()) && !Position::nodeIsUserSelectNone(m_anchorNode->parentNode());
 
-    if (!is<HTMLHtmlElement>(*m_anchorNode) && is<RenderBlockFlow>(*renderer)) {
-        RenderBlockFlow& block = downcast<RenderBlockFlow>(*renderer);
+    if (!is<HTMLHtmlElement>(*m_anchorNode) && (is<RenderBlockFlow>(*renderer) || is<RenderGrid>(*renderer) || is<RenderFlexibleBox>(*renderer))) {
+        auto& block = downcast<RenderBlock>(*renderer);
         if (block.logicalHeight() || is<HTMLBodyElement>(*m_anchorNode)) {
             if (!Position::hasRenderedNonAnonymousDescendantsWithHeight(block))