Title: [276546] trunk/Source/WebCore
Revision
276546
Author
commit-qu...@webkit.org
Date
2021-04-23 23:11:00 -0700 (Fri, 23 Apr 2021)

Log Message

Crash in IndentOutdentCommand::outdentParagraph attempting to move a paragraph
https://bugs.webkit.org/show_bug.cgi?id=224909

Patch by Ian Gilbert <i...@apple.com> on 2021-04-23
Reviewed by Ryosuke Niwa.

Added check inside IndentOutdentCommand::outdentParagraph to ensure that inserting a
HTMLBRElement was successful before attempting to move a paragraph to that node.

* editing/IndentOutdentCommand.cpp:
(WebCore::IndentOutdentCommand::outdentParagraph):

Modified Paths

Diff

Modified: trunk/Source/WebCore/ChangeLog (276545 => 276546)


--- trunk/Source/WebCore/ChangeLog	2021-04-24 00:47:50 UTC (rev 276545)
+++ trunk/Source/WebCore/ChangeLog	2021-04-24 06:11:00 UTC (rev 276546)
@@ -1,3 +1,16 @@
+2021-04-23  Ian Gilbert  <i...@apple.com>
+
+        Crash in IndentOutdentCommand::outdentParagraph attempting to move a paragraph
+        https://bugs.webkit.org/show_bug.cgi?id=224909
+
+        Reviewed by Ryosuke Niwa.
+
+        Added check inside IndentOutdentCommand::outdentParagraph to ensure that inserting a 
+        HTMLBRElement was successful before attempting to move a paragraph to that node.
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::outdentParagraph):
+
 2021-04-23  Ryosuke Niwa  <rn...@webkit.org>
 
         Crash in constructCustomElementSynchronously

Modified: trunk/Source/WebCore/editing/IndentOutdentCommand.cpp (276545 => 276546)


--- trunk/Source/WebCore/editing/IndentOutdentCommand.cpp	2021-04-24 00:47:50 UTC (rev 276545)
+++ trunk/Source/WebCore/editing/IndentOutdentCommand.cpp	2021-04-24 06:11:00 UTC (rev 276546)
@@ -191,9 +191,9 @@
         splitElement(*enclosingNode, highestInlineNode ? *highestInlineNode : *visibleStartOfParagraph.deepEquivalent().deprecatedNode());
     }
     auto placeholder = HTMLBRElement::create(document());
-    auto* placeholderPtr = placeholder.ptr();
-    insertNodeBefore(WTFMove(placeholder), *splitBlockquoteNode);
-    moveParagraph(startOfParagraph(visibleStartOfParagraph), endOfParagraph(visibleEndOfParagraph), positionBeforeNode(placeholderPtr), true);
+    insertNodeBefore(placeholder, *splitBlockquoteNode);
+    if (placeholder->isConnected())
+        moveParagraph(startOfParagraph(visibleStartOfParagraph), endOfParagraph(visibleEndOfParagraph), positionBeforeNode(placeholder.ptr()), true);
 }
 
 // FIXME: We should merge this function with ApplyBlockElementCommand::formatSelection
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to