nephele
/
haikuwebkit
1
0
Fork 0
Code Issues Releases Activity
haikuwebkit/LayoutTests/editing/execCommand/font-size-delta-crash-expec...

3 lines
305 B
Plaintext
Raw Permalink Normal View History

Nullptr crash in ApplyStyleCommand::applyRelativeFontStyleChange https://bugs.webkit.org/show_bug.cgi?id=221393 Reviewed by Ryosuke Niwa. Source/WebCore: Applying a font style change over a range of nodes might change the node tree because in some cases a span element needs to be created to wrap nodes so they could be styled. Apart from that consecutive identical span nodes could be merged together. This means that the loop that iterates over a range of nodes might actually surpass the end node if that end node was merged into some other. Test: editing/execCommand/font-size-delta-crash.html * editing/ApplyStyleCommand.cpp: (WebCore::ApplyStyleCommand::applyRelativeFontStyleChange): Exit the loop if the iterator becomes a child of the beyondEnd node because the latter was merged into the node that wraps the iterator. LayoutTests: * editing/execCommand/font-size-delta-crash-expected.txt: Added. * editing/execCommand/font-size-delta-crash.html: Added. Canonical link: https://commits.webkit.org/234507@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@273380 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2021-02-24 12:53:56 +00:00
// <-- magic whitespace onload = () => { document.querySelector('script').appendChild(document.createElement('span')); document.execCommand('FindString', false, 'a'); document.execCommand('FontSizeDelta', false, '1'); }; if (window.testRunner) testRunner.dumpAsText();
The test PASS if it does not CRASH.