nephele
/
haikuwebkit
1
0
Fork 0
Code Issues Releases Activity
haikuwebkit/LayoutTests/fast/editing/replace-selection-and-apply...

5 lines
59 B
Plaintext
Raw Permalink Normal View History

Crash in makeBoundaryPoint via ReplaceSelectionCommand::insertedContentRange https://bugs.webkit.org/show_bug.cgi?id=221509 Patch by Frederic Wang <fwang@igalia.com> on 2021-03-16 Reviewed by Ryosuke Niwa. Source/WebCore: WebCore::ReplaceSelectionCommand::doApply() saves start/end positions of inserted content into m_startOfInsertedContent and m_endOfInsertedContent. At the end, it calls ReplaceSelectionCommand::completeHTMLReplacement() which in turn may deep clone part of the inserted content, in order to apply style. This then result in the start/end anchor nodes becoming orphan, causing nullptr dereference later in the code. Ideally, the anchor nodes should be moved to the cloned nodes but this patch only works around the issue by resetting the start/end positions. Test: fast/editing/replace-selection-and-apply-style-crash.html * editing/ReplaceSelectionCommand.cpp: (WebCore::ReplaceSelectionCommand::completeHTMLReplacement): If one of the anchor nodes became orphan, just clear m_startOfInsertedContent and m_endOfInsertedContent. LayoutTests: Add a regression test. * fast/editing/replace-selection-and-apply-style-crash-expected.txt: Added. * fast/editing/replace-selection-and-apply-style-crash.html: Added. Canonical link: https://commits.webkit.org/235328@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@274472 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2021-03-16 12:20:31 +00:00
CONSOLE MESSAGE: This test passes if it does not crash.