commit 083fe7e36e7856b7d19af94924d0f8cc7c351fef
author sihui_liu@apple.com <sihui_liu@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Tue Sep 22 22:21:43 2020 +0000
committer sihui_liu@apple.com <sihui_liu@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Tue Sep 22 22:21:43 2020 +0000
tree 725e68a33422bac197e5e6633890f22356579949
parent 9a6237976ca3c50e0134f8668e7115eda7ee198c

REGRESSION(r266075): WebContent process crashes at TextManipulationController::getPath
https://bugs.webkit.org/show_bug.cgi?id=216846

Reviewed by Wenson Hsieh.

Source/WebCore:

TextIterator does not visit node that has no renderer, so if node has become hidden, TextManipulationController
will not find content node in paragraph range during replacement.

API Test: TextManipulation.CompleteTextManipulationParagraphBecomesHidden

* editing/TextManipulationController.cpp:
(WebCore::TextManipulationController::replace):

Tools:

* TestWebKitAPI/Tests/WebKitCocoa/TextManipulation.mm:
(TestWebKitAPI::TEST):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@267439 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/WebCore/editing/TextManipulationController.cpp

diff --git a/Source/WebCore/editing/TextManipulationController.cpp b/Source/WebCore/editing/TextManipulationController.cpp
index 9baf230..ed44596 100644
--- a/Source/WebCore/editing/TextManipulationController.cpp
+++ b/Source/WebCore/editing/TextManipulationController.cpp
@@ -828,6 +828,9 @@
         }
     }
 
+    if (!firstContentNode)
+        return ManipulationFailureType::ContentChanged;
+
     while (lastChildOfCommonAncestorInRange && lastChildOfCommonAncestorInRange->parentNode() != commonAncestor)
         lastChildOfCommonAncestorInRange = lastChildOfCommonAncestorInRange->parentNode();