Changeset 282503 in webkit

Timestamp:

Sep 16, 2021, 1:14:44 AM (5 years ago)

Author:

Adrian Perez de Castro

Message:

Merge r275972 - Crash in ReplaceSelectionCommand::removeUnrenderedTextNodesAtEnds()
​https://bugs.webkit.org/show_bug.cgi?id=224520

Patch by Julian Gonzalez <​julian_a_gonzalez@apple.com> on 2021-04-14
Reviewed by Ryosuke Niwa.

Adopt RefPtr<Node> instead of using plain Node* here to avoid a crash.

• editing/ReplaceSelectionCommand.cpp:

(WebCore::ReplaceSelectionCommand::removeUnrenderedTextNodesAtEnds):

Location:

releases/WebKitGTK/webkit-2.32/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• editing/ReplaceSelectionCommand.cpp (modified) (2 diffs)

releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog

@@ +1 @@
+2021-04-14  Julian Gonzalez  <julian_a_gonzalez@apple.com>
+
+        Crash in ReplaceSelectionCommand::removeUnrenderedTextNodesAtEnds()
+        https://bugs.webkit.org/show_bug.cgi?id=224520
+
+        Reviewed by Ryosuke Niwa.
+
+        Adopt RefPtr<Node> instead of using plain Node* here to avoid a crash.
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::removeUnrenderedTextNodesAtEnds):
+
 2021-04-14  Carlos Garcia Campos  <cgarcia@igalia.com>
 

releases/WebKitGTK/webkit-2.32/Source/WebCore/editing/ReplaceSelectionCommand.cpp

@@ -829 +829 @@
     document().updateLayoutIgnorePendingStylesheets();
 
-    Node* lastLeafInserted = insertedNodes.lastLeafInserted();
+    auto lastLeafInserted = makeRefPtr(insertedNodes.lastLeafInserted());
     if (is<Text>(lastLeafInserted) && !hasRenderedText(downcast<Text>(*lastLeafInserted))
-        && !enclosingElementWithTag(firstPositionInOrBeforeNode(lastLeafInserted), selectTag)
-        && !enclosingElementWithTag(firstPositionInOrBeforeNode(lastLeafInserted), scriptTag)) {
-        insertedNodes.willRemoveNode(lastLeafInserted);
+        && !enclosingElementWithTag(firstPositionInOrBeforeNode(lastLeafInserted.get()), selectTag)
+        && !enclosingElementWithTag(firstPositionInOrBeforeNode(lastLeafInserted.get()), scriptTag)) {
+        insertedNodes.willRemoveNode(lastLeafInserted.get());
         removeNode(*lastLeafInserted);
     }
@@ -841 +841 @@
     // We don't have to make sure that firstNodeInserted isn't inside a select or script element
     // because it is a top level node in the fragment and the user can't insert into those elements.
-    Node* firstNodeInserted = insertedNodes.firstNodeInserted();
+    auto firstNodeInserted = makeRefPtr(insertedNodes.firstNodeInserted());
     if (is<Text>(firstNodeInserted) && !hasRenderedText(downcast<Text>(*firstNodeInserted))) {
-        insertedNodes.willRemoveNode(firstNodeInserted);
+        insertedNodes.willRemoveNode(firstNodeInserted.get());
         removeNode(*firstNodeInserted);
     }