| Summary: | Nullptr crash in CompositeEditCommand::splitTreeToNode when inserting list with read-only user-modify | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Jack <shihchieh_lee> | ||||||||||
| Component: | HTML Editing | Assignee: | Nobody <webkit-unassigned> | ||||||||||
| Status: | RESOLVED FIXED | ||||||||||||
| Severity: | Normal | CC: | bfulgham, commit-queue, ews-feeder, product-security, rniwa, simon.fraser, webkit-bug-importer, wenson_hsieh, zalan | ||||||||||
| Priority: | P2 | Keywords: | InRadar | ||||||||||
| Version: | WebKit Nightly Build | ||||||||||||
| Hardware: | Unspecified | ||||||||||||
| OS: | Unspecified | ||||||||||||
| Attachments: |
|
||||||||||||
|
Description
Jack
2020-02-20 17:01:13 PST
In this test case, body contains a list item that is not enclosed by unordered list. Therefore, when JS tries to insert a list, ”fixOrphanedListChild(*listChildNode)” is called to create a HTMLUListElement and append list item to it. However, in CSS the ul is set to “-webkit-user-modify: read-only;”, so append is skipped. This results in li being parentless and the ul childless. Eventually in function splitTreeToNode, we dierectly access the parent of li and cuase nullptr crash.
<style>
dir { -webkit-user-modify: read-write; }
ul { -webkit-user-modify: read-only;}
</style>
<script>
onload = function fun() {
window.getSelection().setBaseAndExtent(LI,0,LI,0);
document.execCommand("insertOrderedList", false);
}
</script>
<body><dir><li id=LI>
Render tree before fixOrphanedListChild(*listChildNode) is called:
(B)lock/(I)nline/I(N)line-block, (A)bsolute/Fi(X)ed/(R)elative/Stic(K)y, (F)loating, (O)verflow clip, Anon(Y)mous, (G)enerated, has(L)ayer, (C)omposited, (+)Dirty style, (+)Dirty layout
B---YGL- -- RenderView at (0,0) size 800x600 renderer->(0x617000103080)
B-----L- -- HTML RenderBlock at (0,0) size 800x600 renderer->(0x61200003ed40) node->(0x60c000107800)
B------- -- BODY RenderBody at (8,8) size 784x576 renderer->(0x61200003eec0) node->(0x60c0001087c0)
B------- --* DIR RenderBlock at (0,0) size 784x18 renderer->(0x61200003f040) node->(0x60c000108880)
B------- -- LI RenderListItem at (40,0) size 744x18 renderer->(0x61200003f1c0) node->(0x60c000108940)
-------- -- RootInlineBox at (0,0) size 14x18 (0x610000051640) renderer->(0x61200003f1c0)
-------- -- InlineBox at (-1,0) size 7x18 (0x607000155960) renderer->(0x61200003f4c0)
I---YG-- -- RenderListMarker at (-1,0) size 7x18 renderer->(0x61200003f4c0)
Render tree after fixOrphanedListChild(*listChildNode) is called:
(B)lock/(I)nline/I(N)line-block, (A)bsolute/Fi(X)ed/(R)elative/Stic(K)y, (F)loating, (O)verflow clip, Anon(Y)mous, (G)enerated, has(L)ayer, (C)omposited, (+)Dirty style, (+)Dirty layout
B---YGL- -+ RenderView at (0,0) size 800x600 renderer->(0x617000103080) layout->[normal child]
B-----L- -+ HTML RenderBlock at (0,0) size 800x600 renderer->(0x61200003ed40) node->(0x60c000107800) layout->[normal child]
B------- -+ BODY RenderBody at (8,8) size 784x576 renderer->(0x61200003eec0) node->(0x60c0001087c0) layout->[normal child]
B------- -+ DIR RenderBlock at (0,0) size 784x18 renderer->(0x61200003f040) node->(0x60c000108880) layout->[normal child]
B------- -+* UL RenderBlock at (0,0) size 0x0 renderer->(0x612000081dc0) node->(0x60c0000fed40) layout->[self]
Created attachment 391363 [details]
Patch
Comment on attachment 391363 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=391363&action=review > Source/WebCore/editing/InsertListCommand.cpp:213 > + // If UL is not editable, listChildNode cannot be appended to a list, so fixOrphanedListChild() returns nullptr. I don’t think we need this comment since anyone looking at this code can just look the code of fixOrphanedListChild. > Source/WebCore/editing/InsertListCommand.cpp:214 > + HTMLElement* listElement = fixOrphanedListChild(*listChildNode); Please store this in RefPtr Created attachment 391367 [details]
Patch
Created attachment 391375 [details]
Patch
Created attachment 391386 [details]
Patch
This is not a security bug. Comment on attachment 391386 [details] Patch Clearing flags on attachment: 391386 Committed r257407: <https://trac.webkit.org/changeset/257407> All reviewed patches have been landed. Closing bug. |