Changeset 280833 in webkit

Timestamp:

Aug 10, 2021, 2:27:19 AM (5 years ago)

Author:

Adrian Perez de Castro

Message:

Merge r274131 - Crash in in ReplaceSelectionCommand::mergeEndIfNeeded()
​https://bugs.webkit.org/show_bug.cgi?id=222941

Patch by Julian Gonzalez <​julian_a_gonzalez@apple.com> on 2021-03-08
Reviewed by Ryosuke Niwa.

Make a copy of Ref<HTMLBRElement> when inserting before start of paragraph.

• editing/ReplaceSelectionCommand.cpp:

(WebCore::ReplaceSelectionCommand::mergeEndIfNeeded):

Location:

releases/WebKitGTK/webkit-2.32/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• editing/ReplaceSelectionCommand.cpp (modified) (1 diff)

releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog

@@ +1 @@
+2021-03-08  Julian Gonzalez  <julian_a_gonzalez@apple.com>
+
+        Crash in in ReplaceSelectionCommand::mergeEndIfNeeded()
+        https://bugs.webkit.org/show_bug.cgi?id=222941
+
+        Reviewed by Ryosuke Niwa.
+
+        Make a copy of Ref<HTMLBRElement> when inserting before start of paragraph.
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::mergeEndIfNeeded):
+
 2021-03-08  Carlos Garcia Campos  <cgarcia@igalia.com>
 

releases/WebKitGTK/webkit-2.32/Source/WebCore/editing/ReplaceSelectionCommand.cpp

@@ -968 +968 @@
     if (endOfParagraph(startOfParagraphToMove) == destination) {
         auto placeholder = HTMLBRElement::create(document());
-        auto* placeholderPtr = placeholder.ptr();
-        insertNodeBefore(WTFMove(placeholder), *startOfParagraphToMove.deepEquivalent().deprecatedNode());
-        destination = VisiblePosition(positionBeforeNode(placeholderPtr));
+        insertNodeBefore(placeholder.copyRef(), *startOfParagraphToMove.deepEquivalent().deprecatedNode());
+        destination = VisiblePosition(positionBeforeNode(placeholder.ptr()));
     }