Changeset 190835 in webkit

Timestamp:

Oct 9, 2015 7:53:53 PM (9 years ago)

Author:

Alan Bujtas

Message:

Check if start and end positions are still valid after updating them through VisibleSelection.
​https://bugs.webkit.org/show_bug.cgi?id=149982

Reviewed by Ryosuke Niwa.

This patch is required to be able to clean up anonymous tables structure.
In certain edge cases, start/end positions could become nullptr after various text splitting
operations.

Covered by editing/execCommand/crash-137961.html

• editing/ApplyStyleCommand.cpp:

(WebCore::ApplyStyleCommand::applyRelativeFontStyleChange):
(WebCore::ApplyStyleCommand::applyInlineStyle):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• editing/ApplyStyleCommand.cpp (modified) (5 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2015-10-09  Zalan Bujtas  <zalan@apple.com>
+
+        Check if start and end positions are still valid after updating them through VisibleSelection.
+        https://bugs.webkit.org/show_bug.cgi?id=149982
+
+        Reviewed by Ryosuke Niwa.
+
+        This patch is required to be able to clean up anonymous tables structure.
+        In certain edge cases, start/end positions could become nullptr after various text splitting
+        operations. 
+
+        Covered by editing/execCommand/crash-137961.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::applyRelativeFontStyleChange):
+        (WebCore::ApplyStyleCommand::applyInlineStyle):
+
 2015-10-09  Simon Fraser  <simon.fraser@apple.com>
 

trunk/Source/WebCore/editing/ApplyStyleCommand.cpp

@@ -340 +340 @@
     }
 
+    if (start.isNull() || end.isNull())
+        return;
+
     if (isValidCaretPositionInTextNode(end)) {
         splitTextAtEnd(start, end);
@@ -345 +348 @@
         end = endPosition();
     }
+
+    if (start.isNull() || end.isNull())
+        return;
 
     // Calculate loop end point.
@@ -587 +593 @@
     }
 
+    if (start.isNull() || end.isNull())
+        return;
+
     // split the end node and containing element if the selection ends inside of it
     bool splitEnd = isValidCaretPositionInTextNode(end);
@@ -598 +607 @@
         endDummySpanAncestor = dummySpanAncestorForNode(end.deprecatedNode());
     }
+
+    if (start.isNull() || end.isNull())
+        return;
 
     // Remove style from the selection.
@@ -650 +662 @@
         end = endPosition();
     }
+
+    if (start.isNull() || end.isNull())
+        return;
 
     // update document layout once before running the rest of the function