Bug 31023 – Safari crashes when calling execCommand on formatted html in special case

• Status: RESOLVED
• Resolution: FIXED
• Component: HTML Editing

[Enrica Casucci]

Imagine to use your WebMail allowing to compose a message in HTML format. You obtain a new message and wants to reply, so:

1. have specially crafted HTML text, e.g.:

<span>
Line 1.
<br>
<b>Select all text in this line and use justify command. Actual result: Safari crashes.</b>
<br>
Line 3.
</span>

2. select all text in the 2nd line

3. try to center the line: document.execCommand('JustifyCenter', false, null) is called

Actual result: unexpected crash

[Enrica Casucci]

Created attachment 42332 [details]
Patch

[Adele Peterson]

Comment on attachment 42332 [details]
Patch

You should add a newline at the end of your test to prevent that warning.  r=me!

Comment on attachment 42332 [details]
Patch

> +    RenderObject* cb = containingBlock();
> +    if (cb)
> +        cb->setSelectionState(state);

We usually combine such cases into
if (RenderObject* cb = containingBlock())
    cb->setSelectionState(state);

I think you can also use a RenderBlock* because that’s the return type of containingBlock().

> +</html>
> \ No newline at end of file

Please add a newline.

[Enrica Casucci]

Committed revision 50433.