Null dereference loading Blink layout test editing/execCommand/crash-replacing-list...
authorcommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 26 Oct 2015 23:08:06 +0000 (23:08 +0000)
committercommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 26 Oct 2015 23:08:06 +0000 (23:08 +0000)
https://bugs.webkit.org/show_bug.cgi?id=149288
<rdar://problem/22746310>

Patch by Jiewen Tan <jiewen_tan@apple.com> on 2015-10-26
Reviewed by Chris Dumez.

Source/WebCore:

This is a merge of Blink r170821:
https://codereview.chromium.org/220233013

Test: editing/execCommand/crash-replacing-list-by-list.html

* editing/ReplaceSelectionCommand.cpp:
(WebCore::ReplaceSelectionCommand::insertAsListItems):

LayoutTests:

* editing/execCommand/crash-replacing-list-by-list-expected.txt: Added.
* editing/execCommand/crash-replacing-list-by-list.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@191609 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/editing/execCommand/crash-replacing-list-by-list-expected.txt [new file with mode: 0644]
LayoutTests/editing/execCommand/crash-replacing-list-by-list.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/editing/ReplaceSelectionCommand.cpp

index ce3d528..a2e0d71 100644 (file)
@@ -1,5 +1,16 @@
 2015-10-26  Jiewen Tan  <jiewen_tan@apple.com>
 
+        Null dereference loading Blink layout test editing/execCommand/crash-replacing-list-by-list.html
+        https://bugs.webkit.org/show_bug.cgi?id=149288
+        <rdar://problem/22746310>
+
+        Reviewed by Chris Dumez.
+
+        * editing/execCommand/crash-replacing-list-by-list-expected.txt: Added.
+        * editing/execCommand/crash-replacing-list-by-list.html: Added.
+
+2015-10-26  Jiewen Tan  <jiewen_tan@apple.com>
+
         Null dereference loading Blink layout test editing/execCommand/insert-image-changing-visibility-crash.html
         https://bugs.webkit.org/show_bug.cgi?id=150208
         <rdar://problem/23137109>
diff --git a/LayoutTests/editing/execCommand/crash-replacing-list-by-list-expected.txt b/LayoutTests/editing/execCommand/crash-replacing-list-by-list-expected.txt
new file mode 100644 (file)
index 0000000..4aeda1f
--- /dev/null
@@ -0,0 +1 @@
+Passes if it does not crash.
diff --git a/LayoutTests/editing/execCommand/crash-replacing-list-by-list.html b/LayoutTests/editing/execCommand/crash-replacing-list-by-list.html
new file mode 100644 (file)
index 0000000..9b77477
--- /dev/null
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<body>
+Passes if it does not crash.
+<div id="sample" contenteditable="true"><ol><li><br></li></ol></div>
+</body>
+<script>
+if (window.testRunner)
+    testRunner.dumpAsText();
+var sample = document.getElementById('sample');
+getSelection().selectAllChildren(sample);
+document.execCommand('InsertHTML', false, '<ul>');
+sample.outerHTML = '';
+</script>
index 2d5374c..6c2c614 100644 (file)
@@ -1,5 +1,21 @@
 2015-10-26  Jiewen Tan  <jiewen_tan@apple.com>
 
+        Null dereference loading Blink layout test editing/execCommand/crash-replacing-list-by-list.html
+        https://bugs.webkit.org/show_bug.cgi?id=149288
+        <rdar://problem/22746310>
+
+        Reviewed by Chris Dumez.
+
+        This is a merge of Blink r170821:
+        https://codereview.chromium.org/220233013
+
+        Test: editing/execCommand/crash-replacing-list-by-list.html
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::insertAsListItems):
+
+2015-10-26  Jiewen Tan  <jiewen_tan@apple.com>
+
         Null dereference loading Blink layout test editing/execCommand/insert-image-changing-visibility-crash.html
         https://bugs.webkit.org/show_bug.cgi?id=150208
         <rdar://problem/23137109>
index 6f4a8e1..670f278 100644 (file)
@@ -1464,7 +1464,7 @@ Node* ReplaceSelectionCommand::insertAsListItems(PassRefPtr<HTMLElement> prpList
         } else
             ASSERT_NOT_REACHED();
     }
-    if (isStart || isMiddle)
+    if ((isStart || isMiddle) && lastNode->previousSibling())
         lastNode = lastNode->previousSibling();
     return lastNode;
 }