Title: [273375] trunk
- Revision
- 273375
- Author
- [email protected]
- Date
- 2021-02-24 01:20:30 -0800 (Wed, 24 Feb 2021)
Log Message
Nullptr crash in CompositeEditCommand::splitTreeToNode via InsertParagraphSeparatorCommand::doApply
https://bugs.webkit.org/show_bug.cgi?id=221387
Patch by Frederic Wang <[email protected]> on 2021-02-24
Reviewed by Ryosuke Niwa.
Source/WebCore:
WebCore::Position::upstream behaves specially for table renderer, which may confuse the
execution of WebCore::InsertParagraphSeparatorCommand::doApply() when the visible position
is within a table, leading to a debug assertion failure and a nullptr dereference in release
build. This patch fixes that by forcing createFragmentFromText to convert <table> to new
a default paragraph element.
Test: fast/editing/paste-and-match-style-with-table-crash.html
* editing/markup.cpp:
(WebCore::createFragmentFromText): Don't clone enclosing block that are <table>.
LayoutTests:
* fast/editing/paste-and-match-style-with-table-crash-expected.txt: Added.
* fast/editing/paste-and-match-style-with-table-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (273374 => 273375)
--- trunk/LayoutTests/ChangeLog 2021-02-24 08:42:16 UTC (rev 273374)
+++ trunk/LayoutTests/ChangeLog 2021-02-24 09:20:30 UTC (rev 273375)
@@ -1,3 +1,13 @@
+2021-02-24 Frederic Wang <[email protected]>
+
+ Nullptr crash in CompositeEditCommand::splitTreeToNode via InsertParagraphSeparatorCommand::doApply
+ https://bugs.webkit.org/show_bug.cgi?id=221387
+
+ Reviewed by Ryosuke Niwa.
+
+ * fast/editing/paste-and-match-style-with-table-crash-expected.txt: Added.
+ * fast/editing/paste-and-match-style-with-table-crash.html: Added.
+
2021-02-24 Carlos Garcia Campos <[email protected]>
Nullptr crash in Document::contextDocument() inside FontFaceSet::FontFaceSet
Added: trunk/LayoutTests/fast/editing/paste-and-match-style-with-table-crash-expected.txt (0 => 273375)
--- trunk/LayoutTests/fast/editing/paste-and-match-style-with-table-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/editing/paste-and-match-style-with-table-crash-expected.txt 2021-02-24 09:20:30 UTC (rev 273375)
@@ -0,0 +1,4 @@
+CONSOLE MESSAGE: This test passes if it does not crash.
+head, style { display: block; }
+
+
Added: trunk/LayoutTests/fast/editing/paste-and-match-style-with-table-crash.html (0 => 273375)
--- trunk/LayoutTests/fast/editing/paste-and-match-style-with-table-crash.html (rev 0)
+++ trunk/LayoutTests/fast/editing/paste-and-match-style-with-table-crash.html 2021-02-24 09:20:30 UTC (rev 273375)
@@ -0,0 +1,18 @@
+<style>
+ head, style {
+ display: block;
+ }
+</style>
+<script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+ _onload_ = () => {
+ console.log("This test passes if it does not crash.");
+ document.execCommand('SelectAll');
+ document.execCommand('Copy');
+ document.designMode = 'on';
+ document.execCommand('InsertHorizontalRule');
+ document.body.appendChild(document.createElement('table'));
+ document.execCommand('PasteAndMatchStyle');
+ };
+</script>
Modified: trunk/Source/WebCore/ChangeLog (273374 => 273375)
--- trunk/Source/WebCore/ChangeLog 2021-02-24 08:42:16 UTC (rev 273374)
+++ trunk/Source/WebCore/ChangeLog 2021-02-24 09:20:30 UTC (rev 273375)
@@ -1,3 +1,21 @@
+2021-02-24 Frederic Wang <[email protected]>
+
+ Nullptr crash in CompositeEditCommand::splitTreeToNode via InsertParagraphSeparatorCommand::doApply
+ https://bugs.webkit.org/show_bug.cgi?id=221387
+
+ Reviewed by Ryosuke Niwa.
+
+ WebCore::Position::upstream behaves specially for table renderer, which may confuse the
+ execution of WebCore::InsertParagraphSeparatorCommand::doApply() when the visible position
+ is within a table, leading to a debug assertion failure and a nullptr dereference in release
+ build. This patch fixes that by forcing createFragmentFromText to convert <table> to new
+ a default paragraph element.
+
+ Test: fast/editing/paste-and-match-style-with-table-crash.html
+
+ * editing/markup.cpp:
+ (WebCore::createFragmentFromText): Don't clone enclosing block that are <table>.
+
2021-02-24 Carlos Garcia Campos <[email protected]>
Nullptr crash in Document::contextDocument() inside FontFaceSet::FontFaceSet
Modified: trunk/Source/WebCore/editing/markup.cpp (273374 => 273375)
--- trunk/Source/WebCore/editing/markup.cpp 2021-02-24 08:42:16 UTC (rev 273374)
+++ trunk/Source/WebCore/editing/markup.cpp 2021-02-24 09:20:30 UTC (rev 273375)
@@ -1199,6 +1199,8 @@
bool useClonesOfEnclosingBlock = block
&& !block->hasTagName(bodyTag)
&& !block->hasTagName(htmlTag)
+ // Avoid using table as paragraphs due to its special treatment in Position::upstream/downstream.
+ && !block->hasTagName(tableTag)
&& block != editableRootForPosition(start);
bool useLineBreak = enclosingTextFormControl(start);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
