nephele
/
haikuwebkit
1
0
Fork 0
Code Issues Releases Activity
haikuwebkit/LayoutTests/fast/editing/modify-selection-list-level...

3 lines
40 B
Plaintext
Raw Permalink Normal View History

Nullptr crash in ModifySelectionListLevelCommand::appendSiblingNodeRange https://bugs.webkit.org/show_bug.cgi?id=221650 Patch by Frederic Wang <fwang@igalia.com> on 2021-02-23 Reviewed by Ryosuke Niwa. Source/WebCore: getStartEndListChildren relies on the render tree to move the "end" node to the next sibling, but this does not necessarily correspond to a sibling of the "start" node in the DOM tree. This breaks the assumption of ModifySelectionListLevelCommand::appendSiblingNodeRange that the "start" and "end" nodes are siblings (in that order), causing a null-pointer dereference. This patch fixes the issue by ensuring that getStartEndListChildren does not try to change the "end" node if it is not a sibling of the "start" one. Test: fast/editing/modify-selection-list-level-crash.html * editing/ModifySelectionListLevel.cpp: (WebCore::getStartEndListChildren): Don't change the end node if r->node() is a sibling of startChildList. LayoutTests: * fast/editing/modify-selection-list-level-crash-expected.txt: Added. * fast/editing/modify-selection-list-level-crash.html: Added. Canonical link: https://commits.webkit.org/234462@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@273302 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2021-02-23 12:28:20 +00:00
This test passes if it does not crash.