Changeset 285764 in webkit

Timestamp:

Nov 12, 2021, 5:16:04 PM (5 years ago)

Author:

commit-queue@webkit.org

Message:

Null check m_spanElement
​https://bugs.webkit.org/show_bug.cgi?id=230894

Patch by Rob Buis <​rbuis@igalia.com> on 2021-11-12
Reviewed by Wenson Hsieh.

Source/WebCore:

Null check m_spanElement in ReplaceNodeWithSpanCommand::doUnapply, since
it may not be created by ReplaceNodeWithSpanCommand::doApply.

Test: editing/execCommand/default-paragraph-separator-crash.html

• editing/ReplaceNodeWithSpanCommand.cpp:

(WebCore::ReplaceNodeWithSpanCommand::doUnapply):

• editing/ReplaceSelectionCommand.cpp:

(WebCore::ReplaceSelectionCommand::makeInsertedContentRoundTrippableWithHTMLTreeBuilder):

LayoutTests:

• editing/execCommand/default-paragraph-separator-crash-expected.txt: Added.
• editing/execCommand/default-paragraph-separator-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/editing/execCommand/default-paragraph-separator-crash-expected.txt (added)
• LayoutTests/editing/execCommand/default-paragraph-separator-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/editing/ReplaceNodeWithSpanCommand.cpp (modified) (1 diff)
• Source/WebCore/editing/ReplaceSelectionCommand.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-11-12  Rob Buis  <rbuis@igalia.com>
+
+        Null check m_spanElement
+        https://bugs.webkit.org/show_bug.cgi?id=230894
+
+        Reviewed by Wenson Hsieh.
+
+        * editing/execCommand/default-paragraph-separator-crash-expected.txt: Added.
+        * editing/execCommand/default-paragraph-separator-crash.html: Added.
+
 2021-11-12  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-11-12  Rob Buis  <rbuis@igalia.com>
+
+        Null check m_spanElement
+        https://bugs.webkit.org/show_bug.cgi?id=230894
+
+        Reviewed by Wenson Hsieh.
+
+        Null check m_spanElement in ReplaceNodeWithSpanCommand::doUnapply, since
+        it may not be created by ReplaceNodeWithSpanCommand::doApply.
+
+        Test: editing/execCommand/default-paragraph-separator-crash.html
+
+        * editing/ReplaceNodeWithSpanCommand.cpp:
+        (WebCore::ReplaceNodeWithSpanCommand::doUnapply):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::makeInsertedContentRoundTrippableWithHTMLTreeBuilder):
+
 2021-11-12  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebCore/editing/ReplaceNodeWithSpanCommand.cpp

@@ -69 +69 @@
 void ReplaceNodeWithSpanCommand::doUnapply()
 {
-    if (!m_spanElement->isConnected())
+    if (!m_spanElement || !m_spanElement->isConnected())
         return;
     swapInNodePreservingAttributesAndChildren(m_elementToReplace, *m_spanElement);

trunk/Source/WebCore/editing/ReplaceSelectionCommand.cpp

@@ -796 +796 @@
             continue;
 
+        if (!node->isConnected())
+            continue;
+
         if (isProhibitedParagraphChild(downcast<HTMLElement>(*node).localName())) {
             if (RefPtr paragraphElement = enclosingElementWithTag(positionInParentBeforeNode(node.get()), pTag)) {
                 RefPtr parent { paragraphElement->parentNode() };
-                if (parent && parent->hasEditableStyle())
+                if (parent && parent->hasEditableStyle()) {
                     moveNodeOutOfAncestor(*node, *paragraphElement, insertedNodes);
+                    if (!node->isConnected())
+                        continue;
+                }
             }
         }