Skip to content

GitLab

T
tangled
Commit 90334b80 authored by yosin@chromium.org's avatar yosin@chromium.org
Browse files
Options

Don't use dangling reference in... 

Don't use dangling reference in ReplaceSelectionCommand::removeRedundantStylesAndKeepStyleSpanInline

This patch changes to avoid dangling reference in ReplaceSelectionCommand::removeRedundantStylesAndKeepStyleSpanInline().
In this function, we hold pointer to inlineStyle member in ElemendData from
|node|. The |node| doesn't change in loop body unless it doesn't have a
self-conflicting inline style, e.g. <b style="font-weight: normal">. In this
case, we should update |inlineStyle| variable to new value from ElementData of
newly created element.

Note: Attached test case is failed only on ASAN build by heap-use-after-free.

BUG=356517
TEST=LayoutTests/editing/execCommand/remove-redundant-styles-and-keep-style-span-inline-crashed.html

Review URL: https://codereview.chromium.org/212323004

git-svn-id: svn://svn.chromium.org/blink/trunk@170133 bbb929c8-8fbe-4397-9dbb-9b2b20218538
parent 277370c9
Hide whitespace changes
Inline Side-by-side
Showing with 23 additions and 0 deletions
third_party/WebKit/LayoutTests/editing/execCommand/remove-redundant-styles-and-keep-style-span-inline-crashed.html 0 → 100644
View file @ 90334b80
<!DOCTYPE html>
<head>
<style>
* {
border-image-source: url(foo);
background-position-x: 2147483470%;
font-style: normal;
}
</style>
</head>
<body>
<i>PASS if Blink doesn't crash.</i>
<script>
if (window.testRunner)
testRunner.dumpAsText();
document.designMode = 'on';
document.execCommand('SelectAll');
document.execCommand('Cut');
document.execCommand('Paste');
</script>
</body>
third_party/WebKit/Source/core/editing/ReplaceSelectionCommand.cpp
View file @ 90334b80
...@@ -484,6 +484,7 @@ void ReplaceSelectionCommand::removeRedundantStylesAndKeepStyleSpanInline(Insert ...@@ -484,6 +484,7 @@ void ReplaceSelectionCommand::removeRedundantStylesAndKeepStyleSpanInline(Insert
// e.g. <b style="font-weight: normal;"> is converted to <span style="font-weight: normal;"> // e.g. <b style="font-weight: normal;"> is converted to <span style="font-weight: normal;">
node = replaceElementWithSpanPreservingChildrenAndAttributes(htmlElement); node = replaceElementWithSpanPreservingChildrenAndAttributes(htmlElement);
element = toElement(node); element = toElement(node);
inlineStyle = element->inlineStyle();
insertedNodes.didReplaceNode(*htmlElement, *node); insertedNodes.didReplaceNode(*htmlElement, *node);
} else if (newInlineStyle->extractConflictingImplicitStyleOfAttributes(htmlElement, EditingStyle::PreserveWritingDirection, 0, attributes, } else if (newInlineStyle->extractConflictingImplicitStyleOfAttributes(htmlElement, EditingStyle::PreserveWritingDirection, 0, attributes,
EditingStyle::DoNotExtractMatchingStyle)) { EditingStyle::DoNotExtractMatchingStyle)) {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment