Changeset 94841 in webkit

Timestamp:

Sep 9, 2011 2:13:19 AM (13 years ago)

Author:

commit-queue@webkit.org

Message:

Crashes in WebCore::AppendNodeCommand::create().
​https://bugs.webkit.org/show_bug.cgi?id=67767

Patch by Shinya Kawanaka <​shinyak@google.com> on 2011-09-09
Reviewed by Darin Adler.

Source/WebCore:

In CompositeEditCommand::closeParagraphUnderNewElement(), lastNode could be a non Element node.
The current code assumes lastNode is an Element node. This patch checks it.

Test: editing/execCommand/ident-crashes-topnode-is-text.html

• editing/CompositeEditCommand.cpp:

(WebCore::CompositeEditCommand::cloneParagraphUnderNewElement): Added an element node check.

LayoutTests:

Added a crash test case.

• editing/execCommand/ident-crashes-topnode-is-text-expected.txt: Added.
• editing/execCommand/ident-crashes-topnode-is-text.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/editing/execCommand/ident-crashes-topnode-is-text-expected.txt (added)
• LayoutTests/editing/execCommand/ident-crashes-topnode-is-text.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/editing/CompositeEditCommand.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-09-09  Shinya Kawanaka  <shinyak@google.com>
+
+        Crashes in WebCore::AppendNodeCommand::create().
+        https://bugs.webkit.org/show_bug.cgi?id=67767
+
+        Reviewed by Darin Adler.
+
+        Added a crash test case.
+
+        * editing/execCommand/ident-crashes-topnode-is-text-expected.txt: Added.
+        * editing/execCommand/ident-crashes-topnode-is-text.html: Added.
+
 2011-09-09  Shinya Kawanaka  <shinyak@google.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-09-09  Shinya Kawanaka  <shinyak@google.com>
+
+        Crashes in WebCore::AppendNodeCommand::create().
+        https://bugs.webkit.org/show_bug.cgi?id=67767
+
+        Reviewed by Darin Adler.
+
+        In CompositeEditCommand::closeParagraphUnderNewElement(), lastNode could be a non Element node.
+        The current code assumes lastNode is an Element node. This patch checks it.
+
+        Test: editing/execCommand/ident-crashes-topnode-is-text.html
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement): Added an element node check.
+
 2011-09-09  Shinya Kawanaka  <shinyak@google.com>
 

trunk/Source/WebCore/editing/CompositeEditCommand.cpp

@@ -809 +809 @@
     RefPtr<Node> lastNode = topNode;
 
-    if (start.deprecatedNode() != outerNode) {
+    if (start.deprecatedNode() != outerNode && lastNode->isElementNode()) {
         Vector<RefPtr<Node> > ancestors;