[webkit-reviews] review granted: [Bug 224836] Crash in StyledMarkupAccumulator::traverseNodesForSerialization() : [Attachment 426728] Patch

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Wed Apr 21 12:49:46 PDT 2021

Ryosuke Niwa <rniwa at webkit.org> has granted Julian Gonzalez
<julian_a_gonzalez at apple.com>'s request for review:
Bug 224836: Crash in StyledMarkupAccumulator::traverseNodesForSerialization()

Attachment 426728: Patch


--- Comment #6 from Ryosuke Niwa <rniwa at webkit.org> ---
Comment on attachment 426728
  --> https://bugs.webkit.org/attachment.cgi?id=426728

View in context: https://bugs.webkit.org/attachment.cgi?id=426728&action=review

> Source/WebCore/editing/markup.cpp:715
> +	   bool aboutToGoPastEnd = pastEnd && !didEnterNode &&
(isDescendantOf(*pastEnd, *n) || !next);

Hm... let's flip the last two expressions and check !next first since that's

More information about the webkit-reviews mailing list