| Summary: | ASSERTION FAILURE in AppendNodeCommand::AppendNodeCommand when inserting list with read-only user-modify | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Jack <shihchieh_lee> | ||||||
| Component: | HTML Editing | Assignee: | Nobody <webkit-unassigned> | ||||||
| Status: | RESOLVED FIXED | ||||||||
| Severity: | Normal | CC: | bfulgham, commit-queue, ews-feeder, product-security, rniwa, simon.fraser, webkit-bug-importer, wenson_hsieh, zalan | ||||||
| Priority: | P2 | Keywords: | InRadar | ||||||
| Version: | WebKit Nightly Build | ||||||||
| Hardware: | All | ||||||||
| OS: | All | ||||||||
| Attachments: |
|
||||||||
|
Description
Jack
2020-02-21 00:38:37 PST
Created attachment 391387 [details]
Patch
Created attachment 391388 [details]
Patch
Root cause:
When JS is inserting an ordered list, the code needs to create a ol and move li into newly created ol. However, since ol is read-only, the assertion of m_parent->hasEditableStyle() in AppendNodeCommand::AppendNodeCommand is triggered.
<style>
dir { -webkit-user-modify: read-write; }
ol { -webkit-user-modify: read-only;}
</style>
<script>
onload = function fun() {
window.getSelection().setBaseAndExtent(LI,0,LI,0);
document.execCommand("insertOrderedList", false);
}
</script>
<body><dir><ul><li id=LI></ul>
This is not a security bug. Comment on attachment 391388 [details] Patch Clearing flags on attachment: 391388 Committed r257408: <https://trac.webkit.org/changeset/257408> All reviewed patches have been landed. Closing bug. |