git://git.webkit.org / WebKit-https.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 41892c2)
Null dereference loading Blink layout test editing/execCommand/insert-ordered-list...
authorcommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 26 Oct 2015 22:49:50 +0000 (22:49 +0000)
committercommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 26 Oct 2015 22:49:50 +0000 (22:49 +0000)
https://bugs.webkit.org/show_bug.cgi?id=150209
<rdar://problem/23137198>

Patch by Jiewen Tan <jiewen_tan@apple.com> on 2015-10-26
Reviewed by Chris Dumez.

Source/WebCore:

This is a merge from Blink r168006:
https://codereview.chromium.org/181283002

Test: editing/execCommand/insert-ordered-list-crash.html

* editing/InsertListCommand.cpp:
(WebCore::InsertListCommand::doApply):
setEndingSelection() might change endingSelection(), we should check again.

LayoutTests:

* editing/execCommand/insert-ordered-list-crash-expected.txt: Added.
* editing/execCommand/insert-ordered-list-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@191605 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog patch | blob | history
LayoutTests/editing/execCommand/insert-ordered-list-crash-expected.txt [new file with mode: 0644] patch | blob
LayoutTests/editing/execCommand/insert-ordered-list-crash.html [new file with mode: 0644] patch | blob
Source/WebCore/ChangeLog patch | blob | history
Source/WebCore/editing/InsertListCommand.cpp patch | blob | history

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 1e68548..4e60376 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,5 +1,16 @@
 2015-10-26  Jiewen Tan  <jiewen_tan@apple.com>
 
+        Null dereference loading Blink layout test editing/execCommand/insert-ordered-list-crash.html
+        https://bugs.webkit.org/show_bug.cgi?id=150209
+        <rdar://problem/23137198>
+
+        Reviewed by Chris Dumez.
+
+        * editing/execCommand/insert-ordered-list-crash-expected.txt: Added.
+        * editing/execCommand/insert-ordered-list-crash.html: Added.
+
+2015-10-26  Jiewen Tan  <jiewen_tan@apple.com>
+
         Null dereference loading Blink layout test editing/execCommand/insert-html-to-document-element-crash.html
         https://bugs.webkit.org/show_bug.cgi?id=149294
         <rdar://problem/22746657>
diff --git a/LayoutTests/editing/execCommand/insert-ordered-list-crash-expected.txt b/LayoutTests/editing/execCommand/insert-ordered-list-crash-expected.txt
new file mode 100644 (file)
index 0000000..24892cf
--- /dev/null
+++ b/LayoutTests/editing/execCommand/insert-ordered-list-crash-expected.txt
@@ -0,0 +1 @@
+Pass if not crash.
diff --git a/LayoutTests/editing/execCommand/insert-ordered-list-crash.html b/LayoutTests/editing/execCommand/insert-ordered-list-crash.html
new file mode 100644 (file)
index 0000000..e51c894
--- /dev/null
+++ b/LayoutTests/editing/execCommand/insert-ordered-list-crash.html
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<html>
+<body>
+    <script>
+        document.addEventListener("DOMContentLoaded", function () {
+            document.execCommand("SelectAll", false);
+            window.getSelection().deleteFromDocument();
+        }, true);
+
+        var count = 0;
+        document.addEventListener("DOMSubtreeModified", function () {
+            count++;
+            if (count < 3) {
+                var src = event.srcElement;
+                src.contentEditable = "true";
+                src.innerHTML = '<div></div>';
+                document.execCommand('InsertOrderedList', false, false);
+            }
+            else if (count == 6)
+                document.write('Pass if not crash.')
+        }, false);
+
+        if (window.testRunner)
+            testRunner.dumpAsText();
+    </script>
+    <h5>
+        aa
+        <textarea></textarea>
+    </h5>
+    <dl>
+        aa
+    </dl>
+</body>
+</html>
\ No newline at end of file
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index c258608..534525b 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,5 +1,22 @@
 2015-10-26  Jiewen Tan  <jiewen_tan@apple.com>
 
+        Null dereference loading Blink layout test editing/execCommand/insert-ordered-list-crash.html
+        https://bugs.webkit.org/show_bug.cgi?id=150209
+        <rdar://problem/23137198>
+
+        Reviewed by Chris Dumez.
+
+        This is a merge from Blink r168006:
+        https://codereview.chromium.org/181283002
+
+        Test: editing/execCommand/insert-ordered-list-crash.html
+
+        * editing/InsertListCommand.cpp:
+        (WebCore::InsertListCommand::doApply):
+        setEndingSelection() might change endingSelection(), we should check again.
+
+2015-10-26  Jiewen Tan  <jiewen_tan@apple.com>
+
         Null dereference loading Blink layout test editing/execCommand/insert-html-to-document-element-crash.html
         https://bugs.webkit.org/show_bug.cgi?id=149294
         <rdar://problem/22746657>
diff --git a/Source/WebCore/editing/InsertListCommand.cpp b/Source/WebCore/editing/InsertListCommand.cpp
index 6cd1c5c..ef4f621 100644 (file)
--- a/Source/WebCore/editing/InsertListCommand.cpp
+++ b/Source/WebCore/editing/InsertListCommand.cpp
@@ -127,8 +127,11 @@ void InsertListCommand::doApply()
     // FIXME: We paint the gap before some paragraphs that are indented with left 
     // margin/padding, but not others.  We should make the gap painting more consistent and 
     // then use a left margin/padding rule here.
-    if (visibleEnd != visibleStart && isStartOfParagraph(visibleEnd, CanSkipOverEditingBoundary))
+    if (visibleEnd != visibleStart && isStartOfParagraph(visibleEnd, CanSkipOverEditingBoundary)) {
         setEndingSelection(VisibleSelection(visibleStart, visibleEnd.previous(CannotCrossEditingBoundary), endingSelection().isDirectional()));
+        if (!endingSelection().rootEditableElement())
+            return;
+    }
 
     auto& listTag = (m_type == OrderedList) ? olTag : ulTag;
     if (endingSelection().isRange()) {
Mirror of the WebKit open source project from svn.webkit.org.