[webkit-changes] [WebKit/WebKit] 62a375: Fix SEGV in ReplaceSelectionCommand::makeInsertedC...

[Chirag Shah]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 62a3751abfbc0bda4a9fff41c52e1f4d98e6293e
      https://github.com/WebKit/WebKit/commit/62a3751abfbc0bda4a9fff41c52e1f4d98e6293e
  Author: Chirag M Shah <chirag_m_shah at apple.com>
  Date:   2023-04-17 (Mon, 17 Apr 2023)

  Changed paths:
    A LayoutTests/fast/editing/replace-selection-command-crash-expected.txt
    A LayoutTests/fast/editing/replace-selection-command-crash.html
    M Source/WebCore/editing/ReplaceSelectionCommand.cpp

  Log Message:
  -----------
  Fix SEGV in ReplaceSelectionCommand::makeInsertedContentRoundTrippableWithHTMLTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=255510
rdar://107979390

Reviewed by Ryosuke Niwa.

This change fixes a crash which is caused because we end up in state
where m_lastNodeInserted is NULL after a call to
ReplaceSelectionCommand::InsertedNodes::willRemoveNode, which means that
when makeInsertedContentRoundTrippableWithHTMLTreeBuilder calls
pastLastLeaf() we trip over an assertion.

* LayoutTests/fast/editing/replace-selection-command-crash-expected.txt: Added.
* LayoutTests/fast/editing/replace-selection-command-crash.html: Added.
* Source/WebCore/editing/ReplaceSelectionCommand.cpp:
(WebCore::ReplaceSelectionCommand::InsertedNodes::willRemoveNode):

Canonical link: https://commits.webkit.org/263051@main