Changeset 294281 in webkit

Timestamp:

May 16, 2022, 4:58:42 PM (3 years ago)

Author:

gnavamarino@apple.com

Message:

Crash in WebCore::InsertTextCommand::positionInsideTextNode
​https://bugs.webkit.org/show_bug.cgi?id=240480

Reviewed by Ryosuke Niwa.

Calling pushAnchorElementDown in CompositeEditCommand::positionAvoidingSpecialElementBoundary can
end up removing the startPosition's container node which leaves an invalid endingSelection.

InsertTextCommand::doApply requires a real endingSelection, so we should check if this occurred and bail out.

• editing/InsertTextCommand.cpp:

(WebCore::InsertTextCommand::doApply):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• editing/InsertTextCommand.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2022-05-16  Gabriel Nava Marino  <gnavamarino@apple.com>
+
+        Crash in WebCore::InsertTextCommand::positionInsideTextNode
+        https://bugs.webkit.org/show_bug.cgi?id=240480
+
+        Reviewed by Ryosuke Niwa.
+
+        Calling pushAnchorElementDown in CompositeEditCommand::positionAvoidingSpecialElementBoundary can
+        end up removing the startPosition's container node which leaves an invalid endingSelection.
+
+        InsertTextCommand::doApply requires a real endingSelection, so we should check if this occurred and bail out.
+
+        * editing/InsertTextCommand.cpp:
+        (WebCore::InsertTextCommand::doApply):
+
 2022-05-16  Said Abou-Hallawa  <said@apple.com>
 

trunk/Source/WebCore/editing/InsertTextCommand.cpp

@@ -183 +183 @@
     
     startPosition = positionAvoidingSpecialElementBoundary(startPosition);
-    
+    if (endingSelection().isNoneOrOrphaned())
+        return;
+
     Position endPosition;