Changeset 221128 in webkit

Timestamp:

Aug 23, 2017, 9:12:55 PM (8 years ago)

Author:

Wenson Hsieh

Message:

DeleteSelectionCommand should be robust when starting and ending editable positions cannot be found
​https://bugs.webkit.org/show_bug.cgi?id=175914
<rdar://problem/29792688>

Reviewed by Ryosuke Niwa.

Source/WebCore:

DeleteSelectionCommand can cause a null dereference if editable start and end positions are not found. This can
happen when attempting to delete after selecting the contents within a canvas or output element with read-write
-webkit-user-modify style. To fix this, we make the initialization step of the DeleteSelectionCommand robust
when editable start and end positions are missing.

Test: editing/execCommand/forward-delete-read-write-canvas.html

• editing/DeleteSelectionCommand.cpp:

(WebCore::DeleteSelectionCommand::initializePositionData):

Make this initialization helper indicate failure via a bool return value. DeleteSelectionCommand::doApply bails
early if initializePositionData returned false.

(WebCore::DeleteSelectionCommand::doApply):

• editing/DeleteSelectionCommand.h:

LayoutTests:

Adds a new LayoutTest. This test passes if WebKit successfully loaded the page.

• editing/execCommand/forward-delete-read-write-canvas-expected.txt: Added.
• editing/execCommand/forward-delete-read-write-canvas.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/editing/execCommand/forward-delete-read-write-canvas-expected.txt (added)
• LayoutTests/editing/execCommand/forward-delete-read-write-canvas.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/editing/DeleteSelectionCommand.cpp (modified) (4 diffs)
• Source/WebCore/editing/DeleteSelectionCommand.h (modified) (1 diff)

trunk/LayoutTests/ChangeLog ¶

@@ +1 @@
+2017-08-23  Wenson Hsieh  <wenson_hsieh@apple.com>
+
+        DeleteSelectionCommand should be robust when starting and ending editable positions cannot be found
+        https://bugs.webkit.org/show_bug.cgi?id=175914
+        <rdar://problem/29792688>
+
+        Reviewed by Ryosuke Niwa.
+
+        Adds a new LayoutTest. This test passes if WebKit successfully loaded the page.
+
+        * editing/execCommand/forward-delete-read-write-canvas-expected.txt: Added.
+        * editing/execCommand/forward-delete-read-write-canvas.html: Added.
+
 2017-08-23  Matt Lewis  <jlewis3@apple.com>
 

trunk/Source/WebCore/ChangeLog ¶

@@ +1 @@
+2017-08-23  Wenson Hsieh  <wenson_hsieh@apple.com>
+
+        DeleteSelectionCommand should be robust when starting and ending editable positions cannot be found
+        https://bugs.webkit.org/show_bug.cgi?id=175914
+        <rdar://problem/29792688>
+
+        Reviewed by Ryosuke Niwa.
+
+        DeleteSelectionCommand can cause a null dereference if editable start and end positions are not found. This can
+        happen when attempting to delete after selecting the contents within a canvas or output element with `read-write`
+        `-webkit-user-modify` style. To fix this, we make the initialization step of the DeleteSelectionCommand robust
+        when editable start and end positions are missing.
+
+        Test: editing/execCommand/forward-delete-read-write-canvas.html
+
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::initializePositionData):
+
+        Make this initialization helper indicate failure via a bool return value. DeleteSelectionCommand::doApply bails
+        early if initializePositionData returned false.
+
+        (WebCore::DeleteSelectionCommand::doApply):
+        * editing/DeleteSelectionCommand.h:
+
 2017-08-23  Youenn Fablet  <youenn@apple.com>
 

trunk/Source/WebCore/editing/DeleteSelectionCommand.cpp ¶

@@ -173 +173 @@
 }
     
-void DeleteSelectionCommand::initializePositionData()
+bool DeleteSelectionCommand::initializePositionData()
 {
     Position start, end;
@@ -182 +182 @@
     if (!isEditablePosition(end, ContentIsEditable))
         end = lastEditablePositionBeforePositionInRoot(end, highestEditableRoot(start));
+
+    if (start.isNull() || end.isNull())
+        return false;
 
     m_upstreamStart = start.upstream();
@@ -273 +276 @@
     m_startBlock = enclosingNodeOfType(m_downstreamStart.parentAnchoredEquivalent(), &isBlock, CanCrossEditingBoundary);
     m_endBlock = enclosingNodeOfType(m_upstreamEnd.parentAnchoredEquivalent(), &isBlock, CanCrossEditingBoundary);
+
+    return true;
 }
 
@@ -858 +863 @@
     
     // set up our state
-    initializePositionData();
+    if (!initializePositionData())
+        return;
 
     // Delete any text that may hinder our ability to fixup whitespace after the delete

trunk/Source/WebCore/editing/DeleteSelectionCommand.h ¶

@@ -55 +55 @@
     void initializeStartEnd(Position&, Position&);
     void setStartingSelectionOnSmartDelete(const Position&, const Position&);
-    void initializePositionData();
+    bool initializePositionData();
     void saveTypingStyleState();
     void insertPlaceholderForAncestorBlockContent();