[Editing][BugFix] Check editability in InserListCommand::listifyParagraph

third_party/WebKit/Source/core/editing/commands/InsertListCommand.cpp

 /*
  * Copyright (C) 2006, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 344 matching lines @@
 }
 
 PassRefPtrWillBeRawPtr<HTMLElement> InsertListCommand::listifyParagraph(const VisiblePosition& originalStart, const HTMLQualifiedName& listTag)
 {
     VisiblePosition start = startOfParagraph(originalStart, CanSkipOverEditingBoundary);
     VisiblePosition end = endOfParagraph(start, CanSkipOverEditingBoundary);
 
     if (start.isNull() || end.isNull())
         return nullptr;
 
+    {
+        // The paragraph between |start| and |end| shoule be editable.
+        Position startPosition = start.toParentAnchoredPosition();

[yosin_UTC9, 2016/01/12 05:51:44]

nit: |const Position&|

+        Position endPosition = end.toParentAnchoredPosition();

[yosin_UTC9, 2016/01/12 05:51:44]

nit: |const Position&|

+        if (!isEditablePosition(startPosition) || !isEditablePosition(endPosition))
+            return nullptr;
+        Node* commonAncestor = NodeTraversal::commonAncestor(*startPosition.anchorNode(), *endPosition.anchorNode());
+        if (!commonAncestor || !commonAncestor->hasEditableStyle())
+            return nullptr;
+    }
+
     // Check for adjoining lists.
     RefPtrWillBeRawPtr<HTMLElement> listItemElement = HTMLLIElement::create(document());
     RefPtrWillBeRawPtr<HTMLBRElement> placeholder = HTMLBRElement::create(document());
     appendNode(placeholder, listItemElement);
 
     // Place list item into adjoining lists.
     HTMLElement* previousList = adjacentEnclosingList(start, previousPositionOf(start, CannotCrossEditingBoundary), listTag);
     HTMLElement* nextList = adjacentEnclosingList(start, nextPositionOf(end, CannotCrossEditingBoundary), listTag);
-    RefPtrWillBeRawPtr<HTMLElement> listElement = nullptr;
+    RefPtrWillBeRawPtr<HTMLElement> newListElementToBeInserted = nullptr;

[yosin_UTC9, 2016/01/12 05:51:44]

It seems renaming |listElement| to |lnewListElementToBeInserted| doesn't relate
to fix the bug.
Please have separate CL for renaming.

     if (previousList) {
         appendNode(listItemElement, previousList);
     } else if (nextList) {
         insertNodeAt(listItemElement, positionBeforeNode(nextList));
     } else {
         // Create the list.
-        listElement = createHTMLElement(document(), listTag);
-        appendNode(listItemElement, listElement);
+        newListElementToBeInserted = createHTMLElement(document(), listTag);
+        appendNode(listItemElement, newListElementToBeInserted);
 
         if (start.deepEquivalent() == end.deepEquivalent() && isEnclosingBlock(start.deepEquivalent().anchorNode())) {
             // Inserting the list into an empty paragraph that isn't held open
             // by a br or a '\n', will invalidate start and end.  Insert
             // a placeholder and then recompute start and end.
             RefPtrWillBeRawPtr<HTMLBRElement> placeholder = insertBlockPlaceholder(start.deepEquivalent());
             start = createVisiblePosition(positionBeforeNode(placeholder.get()));
             end = start;
         }
 
         // Insert the list at a position visually equivalent to start of the
         // paragraph that is being moved into the list.
         // Try to avoid inserting it somewhere where it will be surrounded by
         // inline ancestors of start, since it is easier for editing to produce
         // clean markup when inline elements are pushed down as far as possible.
         Position insertionPos(mostBackwardCaretPosition(start.deepEquivalent()));
         // Also avoid the containing list item.
         Node* listChild = enclosingListChild(insertionPos.anchorNode());
         if (isHTMLLIElement(listChild))
             insertionPos = positionInParentBeforeNode(*listChild);
 
-        insertNodeAt(listElement, insertionPos);
+        insertNodeAt(newListElementToBeInserted, insertionPos);
 
         // We inserted the list at the start of the content we're about to move
         // Update the start of content, so we don't try to move the list into itself.  bug 19066
         // Layout is necessary since start's node's inline layoutObjects may have been destroyed by the insertion
         // The end of the content may have changed after the insertion and layout so update it as well.
         if (insertionPos == start.deepEquivalent())
             start = originalStart;
     }
 
     // Inserting list element and list item list may change start of pargraph
     // to move. We calculate start of paragraph again.
     document().updateLayoutIgnorePendingStylesheets();
-    start = startOfParagraph(start, CanSkipOverEditingBoundary);
-    end = endOfParagraph(start, CanSkipOverEditingBoundary);
-    moveParagraph(start, end, createVisiblePosition(positionBeforeNode(placeholder.get())), true);
+    const VisiblePosition paragraphStartToInsert = startOfParagraph(start, CanSkipOverEditingBoundary);

[yosin_UTC9, 2016/01/12 05:51:44]

nit: |const VisiblePosition&|
This is kind of renaming variables and not relate to fix the bug, please have a
separate CL.

+    moveParagraph(paragraphStartToInsert, endOfParagraph(paragraphStartToInsert, CanSkipOverEditingBoundary),
+        createVisiblePosition(positionBeforeNode(placeholder.get())), true);
 
-    if (listElement)
-        return mergeWithNeighboringLists(listElement);
+    if (newListElementToBeInserted)
+        return mergeWithNeighboringLists(newListElementToBeInserted);
 
     if (canMergeLists(previousList, nextList))
         mergeIdenticalElements(previousList, nextList);
 
-    return listElement;
+    return nullptr;
 }
 
 DEFINE_TRACE(InsertListCommand)
 {
     visitor->trace(m_listElement);
     CompositeEditCommand::trace(visitor);
 }
 
 }