Null pointer deference in WebCore::AppendNodeCommand::create
authorrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 21 May 2013 03:18:22 +0000 (03:18 +0000)
committerrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 21 May 2013 03:18:22 +0000 (03:18 +0000)
https://bugs.webkit.org/show_bug.cgi?id=116479

Source/WebCore:

Reviewed by Andreas Kling.

Merge https://chromium.googlesource.com/chromium/blink/+/5cb43002a44f67a60ecf5a7ed76de2d0bcf89eb2

DeleteSelection::makeStylingElementsDirectChildrenOfEditableRootToPreventStyleLoss() make style and link elements
to be the direct children of the editable root. However, these style and link elements are not necessary editable
and WebKit crashes when they are not.

Test: editing/deleting/delete-uneditable-style.html

* editing/DeleteSelectionCommand.cpp:
(WebCore::DeleteSelectionCommand::makeStylingElementsDirectChildrenOfEditableRootToPreventStyleLoss):

LayoutTests:

Reviewed by Andreas Kling.

Add a regression test.

* editing/deleting/delete-uneditable-style-expected.txt: Added.
* editing/deleting/delete-uneditable-style.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@150402 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/editing/deleting/delete-uneditable-style-expected.txt [new file with mode: 0644]
LayoutTests/editing/deleting/delete-uneditable-style.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/editing/DeleteSelectionCommand.cpp

index ec7c09a16987e181e26fc829e9b6fb88a9bc44b1..b8937b8f4eb751ac12b57a025741a57ba786896f 100644 (file)
@@ -1,3 +1,15 @@
+2013-05-20  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Null pointer deference in WebCore::AppendNodeCommand::create
+        https://bugs.webkit.org/show_bug.cgi?id=116479
+
+        Reviewed by Andreas Kling.
+
+        Add a regression test.
+
+        * editing/deleting/delete-uneditable-style-expected.txt: Added.
+        * editing/deleting/delete-uneditable-style.html: Added.
+
 2013-05-20  Ryosuke Niwa  <rniwa@webkit.org>
 
         REGRESSION(r150386): [WK2] loader/go-back-cached-main-resource.html fails
diff --git a/LayoutTests/editing/deleting/delete-uneditable-style-expected.txt b/LayoutTests/editing/deleting/delete-uneditable-style-expected.txt
new file mode 100644 (file)
index 0000000..891c880
--- /dev/null
@@ -0,0 +1,6 @@
+Test that having a non-editable style and link elements does not cause a crash
+| <span>
+|   id="end"
+|   "<#selection-caret>end"
+| "
+"
diff --git a/LayoutTests/editing/deleting/delete-uneditable-style.html b/LayoutTests/editing/deleting/delete-uneditable-style.html
new file mode 100644 (file)
index 0000000..8bc4ccf
--- /dev/null
@@ -0,0 +1,33 @@
+<!DOCTYPE>
+<html>
+<body>
+<script src="../../resources/dump-as-markup.js"></script>
+<div contentEditable id="test">
+    <span id="start">start</span>
+    editable-1
+    <div contentEditable="false">
+        <style>#end { color: red; }</style>
+        <link type="foo" href="bar">
+        uneditable
+    </div>
+    editable-2
+<span id="end">end</span>
+</div>
+<script>
+Markup.description('Test that having a non-editable style and link elements does not cause a crash');
+
+function $(id) { return document.getElementById(id); }
+
+var range = document.createRange();
+range.setStart($('start'));
+range.setEnd($('end'), NaN);
+
+getSelection().addRange(range);
+
+document.execCommand('Delete', null, '');
+
+Markup.dump('test');
+
+</script>
+</body>
+</html>
index 405b6007281a2961e660a061299dcd9bacfd7d65..5fe9b7759bed16ed0a2b5e8c549c5da531d9f94a 100644 (file)
@@ -1,3 +1,21 @@
+2013-05-20  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Null pointer deference in WebCore::AppendNodeCommand::create
+        https://bugs.webkit.org/show_bug.cgi?id=116479
+
+        Reviewed by Andreas Kling.
+        
+        Merge https://chromium.googlesource.com/chromium/blink/+/5cb43002a44f67a60ecf5a7ed76de2d0bcf89eb2
+
+        DeleteSelection::makeStylingElementsDirectChildrenOfEditableRootToPreventStyleLoss() make style and link elements
+        to be the direct children of the editable root. However, these style and link elements are not necessary editable
+        and WebKit crashes when they are not.
+
+        Test: editing/deleting/delete-uneditable-style.html
+
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::makeStylingElementsDirectChildrenOfEditableRootToPreventStyleLoss):
+
 2013-05-20  Beth Dakin  <bdakin@apple.com>
 
         Scrollbars still show sometimes even when WKPageSetSuppressScrollbarAnimations() 
index 43a8ec92359bb7e9e42290a1eb713567809a4fa4..6a65fa1ccbdded053c0c67d1e5faebc78e2e9212 100644 (file)
@@ -426,8 +426,10 @@ void DeleteSelectionCommand::makeStylingElementsDirectChildrenOfEditableRootToPr
         if ((node->hasTagName(styleTag) && !(toElement(node.get())->hasAttribute(scopedAttr))) || node->hasTagName(linkTag)) {
             nextNode = NodeTraversal::nextSkippingChildren(node.get());
             RefPtr<ContainerNode> rootEditableElement = node->rootEditableElement();
-            removeNode(node);
-            appendNode(node, rootEditableElement);
+            if (rootEditableElement) {
+                removeNode(node);
+                appendNode(node, rootEditableElement);
+            }
         }
         node = nextNode;
     }