Bug 45218 – Move functions from Frame to Editor as planned

• Status: RESOLVED
• Resolution: FIXED
• Component: WebCore Misc.

[Darin Adler]

Move functions from Frame to Editor as planned

[Darin Adler]

Created attachment 66972 [details]
Patch

[Early Warning System Bot]

Attachment 66972 [details] did not build on qt:
Build output: http://queues.webkit.org/results/3949295

[WebKit Review Bot]

Attachment 66972 [details] did not build on gtk:
Build output: http://queues.webkit.org/results/3979090

[WebKit Review Bot]

Attachment 66972 [details] did not build on chromium:
Build output: http://queues.webkit.org/results/3919332

[WebKit Review Bot]

Attachment 66972 [details] did not build on win:
Build output: http://queues.webkit.org/results/3985048

[Darin Adler]

Created attachment 67059 [details]
Patch

[Adam Barth]

Comment on attachment 67059 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=67059&action=prettypatch

> WebCore/editing/Editor.cpp:3366
> +    styleElement->appendChild(m_frame->document()->createEditingTextNode(""), ec);
> +    ASSERT(!ec);
This is a security vulnerability.  appendChild fires DOM mutation events, which run JavaScript, which can make |node| point off into unallocated memory.  Please RefPtr node.

> WebCore/editing/Editor.cpp:3394
> +    Node* shadowTreeRoot = selection.shadowTreeRootNode();
I bet this needs to be RefPtr for the same reason.

[Darin Adler]

(In reply to comment #7)
> (From update of attachment 67059 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=67059&action=prettypatch
> 
> > WebCore/editing/Editor.cpp:3366
> > +    styleElement->appendChild(m_frame->document()->createEditingTextNode(""), ec);
> > +    ASSERT(!ec);
> This is a security vulnerability.  appendChild fires DOM mutation events, which run JavaScript, which can make |node| point off into unallocated memory.  Please RefPtr node.

Glad you spotted it. But the node here came from position.node(); Position already holds the node in a RefPtr. I’ll change the code to use position.node() and eliminate the local variable for clarity on this point.

> > WebCore/editing/Editor.cpp:3394
> > +    Node* shadowTreeRoot = selection.shadowTreeRootNode();
> I bet this needs to be RefPtr for the same reason.

I put this in a RefPtr.

[Darin Adler]

Committed r67122: <http://trac.webkit.org/changeset/67122>

[Ryosuke Niwa]

*** Bug 23430 has been marked as a duplicate of this bug. ***