Crashes in WebCore::AppendNodeCommand::create().

https://bugs.webkit.org/show_bug.cgi?id=67767

Patch by Shinya Kawanaka <shinyak@google.com> on 2011-09-09
Reviewed by Darin Adler.

Source/WebCore:

In CompositeEditCommand::closeParagraphUnderNewElement(), lastNode could be a non Element node.
The current code assumes lastNode is an Element node. This patch checks it.

Test: editing/execCommand/ident-crashes-topnode-is-text.html

* editing/CompositeEditCommand.cpp:
(WebCore::CompositeEditCommand::cloneParagraphUnderNewElement): Added an element node check.

LayoutTests:

Added a crash test case.

* editing/execCommand/ident-crashes-topnode-is-text-expected.txt: Added.
* editing/execCommand/ident-crashes-topnode-is-text.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@94841 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent fddb7234
2011-09-09 Shinya Kawanaka <shinyak@google.com>
Crashes in WebCore::AppendNodeCommand::create().
https://bugs.webkit.org/show_bug.cgi?id=67767
Reviewed by Darin Adler.
Added a crash test case.
* editing/execCommand/ident-crashes-topnode-is-text-expected.txt: Added.
* editing/execCommand/ident-crashes-topnode-is-text.html: Added.
2011-09-09 Shinya Kawanaka <shinyak@google.com>
Crashes in WebCore::ApplyStyleCommand.doApply()
execCommand("Indent") was crashing if the top element to be formatted is actually not an element.
The test has passed if it does not crash.
PASS
<script>
if (window.layoutTestController)
layoutTestController.dumpAsText();
function runTest() {
window.getSelection().setBaseAndExtent(start, 0, null, 0);
document.execCommand("Indent");
document.writeln('execCommand("Indent") was crashing if the top element to be formatted is actually not an element.<br>');
document.writeln('The test has passed if it does not crash.<br><br>')
document.writeln('PASS');
}
</script>
<body onLoad="runTest();">
><defs contenteditable="true" id="start">
<rt>AAAAAAA0A0AAAA00
2011-09-09 Shinya Kawanaka <shinyak@google.com>
Crashes in WebCore::AppendNodeCommand::create().
https://bugs.webkit.org/show_bug.cgi?id=67767
Reviewed by Darin Adler.
In CompositeEditCommand::closeParagraphUnderNewElement(), lastNode could be a non Element node.
The current code assumes lastNode is an Element node. This patch checks it.
Test: editing/execCommand/ident-crashes-topnode-is-text.html
* editing/CompositeEditCommand.cpp:
(WebCore::CompositeEditCommand::cloneParagraphUnderNewElement): Added an element node check.
2011-09-09 Shinya Kawanaka <shinyak@google.com>
Crashes in WebCore::ApplyStyleCommand.doApply()
......@@ -808,7 +808,7 @@ void CompositeEditCommand::cloneParagraphUnderNewElement(Position& start, Positi
appendNode(topNode, blockElement);
RefPtr<Node> lastNode = topNode;
if (start.deprecatedNode() != outerNode) {
if (start.deprecatedNode() != outerNode && lastNode->isElementNode()) {
Vector<RefPtr<Node> > ancestors;
// Insert each node from innerNode to outerNode (excluded) in a list.
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment