[webkit-changes] [WebKit/WebKit] ef64a1: ASSERT in appendNode() should not fire when OBJECT...

[Ahmad Saleem]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: ef64a1c22827b69c0e786365e9d13e5b6644505d
      https://github.com/WebKit/WebKit/commit/ef64a1c22827b69c0e786365e9d13e5b6644505d
  Author: Ahmad Saleem <ahmad.saleem792+github at gmail.com>
  Date:   2022-12-07 (Wed, 07 Dec 2022)

  Changed paths:
    A LayoutTests/editing/execCommand/crash-object-cloning-expected.txt
    A LayoutTests/editing/execCommand/crash-object-cloning.html
    M Source/WebCore/editing/CompositeEditCommand.cpp

  Log Message:
  -----------
  ASSERT in appendNode() should not fire when OBJECTS are cloned

ASSERT in appendNode() should not fire when OBJECTS are cloned
https://bugs.webkit.org/show_bug.cgi?id=202906

Reviewed by Ryosuke Niwa.

Merge - https://src.chromium.org/viewvc/blink?view=revision&revision=187132

The ASSERT may be triggered in CompositeEditCommand::appendNode
when the fallback content of an OBJECT element is cloned because
the canHaveChildrenForEditing is not reliable for OBJECTs until
their render object is created. This issue is fixed by ignoring
the return value of canHaveChildrenForEditing when an OBJECT is
created.

* Source/WebCore/editing/CompositeEditCommand.cpp:
(CompositeEditCommand::insertNodeAt): Update Assertion and add comment to explain about assertion
* LayoutTests/editing/execCommand/crash-object-cloning.html: Add Test Case
* LayoutTests/editing/execCommand/crash-object-cloning-expected.txt: Add Test Case Expectation

Canonical link: https://commits.webkit.org/257465@main