Changeset 285813 in webkit

Timestamp:

Nov 15, 2021, 10:56:59 AM (5 years ago)

Author:

commit-queue@webkit.org

Message:

nullptr deref in CompositeEditCommand::insertNodeAt
​https://bugs.webkit.org/show_bug.cgi?id=232837

Patch by Gabriel Nava Marino <​gnavamarino@apple.com> on 2021-11-15
Reviewed by Wenson Hsieh and Darin Adler.

Source/WebCore:

Check endingSelection is not orphan before inserting nodes at
the start position.

Test: fast/editing/editing-position-crash.html

• editing/CreateLinkCommand.cpp:

(WebCore::CreateLinkCommand::doApply):

LayoutTests:

• fast/editing/editing-position-crash-expected.txt: Added.
• fast/editing/editing-position-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/editing/editing-position-crash-expected.txt (added)
• LayoutTests/fast/editing/editing-position-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/editing/CreateLinkCommand.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-11-15  Gabriel Nava Marino  <gnavamarino@apple.com>
+
+        nullptr deref in CompositeEditCommand::insertNodeAt
+        https://bugs.webkit.org/show_bug.cgi?id=232837
+
+        Reviewed by Wenson Hsieh and Darin Adler.
+
+        * fast/editing/editing-position-crash-expected.txt: Added.
+        * fast/editing/editing-position-crash.html: Added.
+
 2021-11-15  Tyler Wilcock  <tyler_w@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-11-15  Gabriel Nava Marino  <gnavamarino@apple.com>
+
+        nullptr deref in CompositeEditCommand::insertNodeAt
+        https://bugs.webkit.org/show_bug.cgi?id=232837
+
+        Reviewed by Wenson Hsieh and Darin Adler.
+
+        Check endingSelection is not orphan before inserting nodes at
+        the start position.
+
+        Test: fast/editing/editing-position-crash.html
+
+        * editing/CreateLinkCommand.cpp:
+        (WebCore::CreateLinkCommand::doApply):
+
 2021-11-15  Andreu Botella  <andreu@andreubotella.com>
 

trunk/Source/WebCore/editing/CreateLinkCommand.cpp

@@ -41 +41 @@
 void CreateLinkCommand::doApply()
 {
-    if (endingSelection().isNone())
+    if (endingSelection().isNoneOrOrphaned())
         return;
-        
+
     auto anchorElement = HTMLAnchorElement::create(document());
     anchorElement->setHref(m_url);