Changeset 285920 in webkit

Timestamp:

Nov 17, 2021, 1:18:30 AM (5 years ago)

Author:

commit-queue@webkit.org

Message:

Null check clonedParent
​https://bugs.webkit.org/show_bug.cgi?id=230713

Patch by Rob Buis <​rbuis@igalia.com> on 2021-11-17
Reviewed by Wenson Hsieh.

Source/WebCore:

Null check clonedParent.

Test: editing/execCommand/insert-newline-in-quoted-content-crash.html

• editing/BreakBlockquoteCommand.cpp:

(WebCore::BreakBlockquoteCommand::doApply):

LayoutTests:

• editing/execCommand/insert-newline-in-quoted-content-crash-expected.txt: Added.
• editing/execCommand/insert-newline-in-quoted-content-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/editing/execCommand/insert-newline-in-quoted-content-crash-expected.txt (added)
• LayoutTests/editing/execCommand/insert-newline-in-quoted-content-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/editing/BreakBlockquoteCommand.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-11-17  Rob Buis  <rbuis@igalia.com>
+
+        Null check clonedParent
+        https://bugs.webkit.org/show_bug.cgi?id=230713
+
+        Reviewed by Wenson Hsieh.
+
+        * editing/execCommand/insert-newline-in-quoted-content-crash-expected.txt: Added.
+        * editing/execCommand/insert-newline-in-quoted-content-crash.html: Added.
+
 2021-11-16  Rob Buis  <rbuis@igalia.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-11-17  Rob Buis  <rbuis@igalia.com>
+
+        Null check clonedParent
+        https://bugs.webkit.org/show_bug.cgi?id=230713
+
+        Reviewed by Wenson Hsieh.
+
+        Null check clonedParent.
+
+        Test: editing/execCommand/insert-newline-in-quoted-content-crash.html
+
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply):
+
 2021-11-16  Rob Buis  <rbuis@igalia.com>
 

trunk/Source/WebCore/editing/BreakBlockquoteCommand.cpp

@@ -169 +169 @@
         RefPtr<Element> clonedParent;
         for (ancestor = ancestors.first(), clonedParent = clonedAncestor->parentElement();
-             ancestor && ancestor != topBlockquote;
-             ancestor = ancestor->parentElement(), clonedParent = clonedParent->parentElement())
+            ancestor && ancestor != topBlockquote;
+            ancestor = ancestor->parentElement(), clonedParent = clonedParent->parentElement()) {
+            if (!clonedParent)
+                break;
             moveRemainingSiblingsToNewParent(ancestor->nextSibling(), 0, *clonedParent);
+        }
 
         // If the startNode's original parent is now empty, remove it