[Webkit-unassigned] [Bug 54396] New: NULL ptr in CompositeEditCommand::moveParagraphs

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=54396

           Summary: NULL ptr in CompositeEditCommand::moveParagraphs
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: PC
        OS/Version: Windows Vista
            Status: NEW
          Severity: Normal
          Priority: P1
         Component: HTML Editing
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: skylined at chromium.org
                CC: rniwa at webkit.org


Created an attachment (id=82324)
 --> (https://bugs.webkit.org/attachment.cgi?id=82324&action=review)
Repro

Chromium: http://code.google.com/p/chromium/issues/detail?id=72931

The code in "CompositeEditCommand::moveParagraphs" calls "comparePositions", which requires its arguments to NOT be NULL positions. The code does not make sure this is true, which can lead to NULL pointer crashes.
--- snip ---
http://codesearch.google.com/codesearch/p?hl=en#OAMlx_jo-ck/src/third_party/WebKit/Source/WebCore/editing/CompositeEditCommand.cpp&q=CompositeEditCommand::moveParagraphs&exact_package=chromium&sa=N&cd=1&ct=rc&l=914
void CompositeEditCommand::moveParagraphs(const VisiblePosition& startOfParagraphToMove, const VisiblePosition& endOfParagraphToMove, const VisiblePosition& destination, bool preserveSelection, bool preserveStyle)
{
    if (startOfParagraphToMove == destination)
        return;

    int startIndex = -1;
    int endIndex = -1;
    int destinationIndex = -1;
    if (preserveSelection && !endingSelection().isNone()) {
        VisiblePosition visibleStart = endingSelection().visibleStart();
        VisiblePosition visibleEnd = endingSelection().visibleEnd();

        bool startAfterParagraph = comparePositions(visibleStart, endOfParagraphToMove) > 0;
        bool endBeforeParagraph = comparePositions(visibleEnd, startOfParagraphToMove) < 0;

--- snip ---
http://codesearch.google.com/codesearch/p?hl=en#OAMlx_jo-ck/src/third_party/WebKit/Source/WebCore/editing/htmlediting.cpp&q=comparePositions&exact_package=chromium&sa=N&cd=1&ct=rc&l=96
// Compare two positions, taking into account the possibility that one or both
// could be inside a shadow tree. Only works for non-null values.
int comparePositions(const Position& a, const Position& b)
{
    Node* nodeA = a.node();
    ASSERT(nodeA);
    Node* nodeB = b.node();
    ASSERT(nodeB);
    int offsetA = a.deprecatedEditingOffset();
    int offsetB = b.deprecatedEditingOffset();

    Node* shadowAncestorA = nodeA->shadowAncestorNode();
    if (shadowAncestorA == nodeA)
        shadowAncestorA = 0;
    Node* shadowAncestorB = nodeB->shadowAncestorNode();
    if (shadowAncestorB == nodeB)
        shadowAncestorB = 0;

    int bias = 0;
    if (shadowAncestorA != shadowAncestorB) {
        if (shadowAncestorA) {
            nodeA = shadowAncestorA;
            offsetA = 0;
            bias = 1;
        }
        if (shadowAncestorB) {
            nodeB = shadowAncestorB;
            offsetB = 0;
            bias = -1;
        }
    }

    int result = Range::compareBoundaryPoints(nodeA, offsetA, nodeB, offsetB);
    return result ? result : bias;
}

int comparePositions(const VisiblePosition& a, const VisiblePosition& b)
{
    return comparePositions(a.deepEquivalent(), b.deepEquivalent());
}
--- snip ---
id:             chrome.dll!WebCore::Node::shadowAncestorNode ReadAV at NULL (f14087038c74efeb219bb061cbb1fa90)
description:    Attempt to read from unallocated NULL pointer+0x24 in chrome.dll!WebCore::Node::shadowAncestorNode
application:    Chromium 11.0.659.0
stack:          chrome.dll!WebCore::Node::shadowAncestorNode
                chrome.dll!WebCore::comparePositions
                chrome.dll!WebCore::comparePositions
                chrome.dll!WebCore::CompositeEditCommand::moveParagraphs
                chrome.dll!WebCore::InsertListCommand::unlistifyParagraph
                chrome.dll!WebCore::InsertListCommand::doApplyForSingleParagraph
                chrome.dll!WebCore::InsertListCommand::doApply
                chrome.dll!WebCore::EditCommand::apply
                chrome.dll!WebCore::CompositeEditCommand::applyCommandToComposite
                chrome.dll!WebCore::IndentOutdentCommand::outdentParagraph
                chrome.dll!WebCore::IndentOutdentCommand::outdentRegion
                chrome.dll!WebCore::ApplyBlockElementCommand::doApply
                chrome.dll!WebCore::EditCommand::apply
                chrome.dll!WebCore::applyCommand
                chrome.dll!WebCore::executeOutdent
                chrome.dll!WebCore::Editor::Command::execute
                chrome.dll!WebCore::Document::execCommand
                chrome.dll!WebCore::DocumentInternal::execCommandCallback
                chrome.dll!v8::internal::HandleApiCallHelper<0>
                chrome.dll!v8::internal::Builtin_HandleApiCall
                chrome.dll!v8::internal::Invoke
                chrome.dll!v8::internal::Execution::Call
                ...
(Actual crash is in WebCore::Node::getFlag, which is inlined and does not show up in the stack trace)

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.