[Editing][BugFix] Check editability in InserListCommand::listifyParagraph

third_party/WebKit/Source/core/editing/commands/InsertListCommand.cpp

Index: third_party/WebKit/Source/core/editing/commands/InsertListCommand.cpp
diff --git a/third_party/WebKit/Source/core/editing/commands/InsertListCommand.cpp b/third_party/WebKit/Source/core/editing/commands/InsertListCommand.cpp
index 1dcb8a8c35ae222f013f6e75806c938d4e6cda72..d22018fcedb3743d2fc5bfed7ef8f9cc4862016c 100644
--- a/third_party/WebKit/Source/core/editing/commands/InsertListCommand.cpp
+++ b/third_party/WebKit/Source/core/editing/commands/InsertListCommand.cpp
@@ -362,6 +362,17 @@ PassRefPtrWillBeRawPtr<HTMLElement> InsertListCommand::listifyParagraph(const Vi
     if (start.isNull() || end.isNull())
         return nullptr;
 
+    {
+        // The paragraph between |start| and |end| shoule be editable.
+        Position startPosition = start.toParentAnchoredPosition();

[yosin_UTC9, 2016/01/12 05:51:44]

nit: |const Position&|

+        Position endPosition = end.toParentAnchoredPosition();

[yosin_UTC9, 2016/01/12 05:51:44]

nit: |const Position&|

+        if (!isEditablePosition(startPosition) || !isEditablePosition(endPosition))
+            return nullptr;
+        Node* commonAncestor = NodeTraversal::commonAncestor(*startPosition.anchorNode(), *endPosition.anchorNode());
+        if (!commonAncestor || !commonAncestor->hasEditableStyle())
+            return nullptr;
+    }
+
     // Check for adjoining lists.
     RefPtrWillBeRawPtr<HTMLElement> listItemElement = HTMLLIElement::create(document());
     RefPtrWillBeRawPtr<HTMLBRElement> placeholder = HTMLBRElement::create(document());
@@ -370,15 +381,15 @@ PassRefPtrWillBeRawPtr<HTMLElement> InsertListCommand::listifyParagraph(const Vi
     // Place list item into adjoining lists.
     HTMLElement* previousList = adjacentEnclosingList(start, previousPositionOf(start, CannotCrossEditingBoundary), listTag);
     HTMLElement* nextList = adjacentEnclosingList(start, nextPositionOf(end, CannotCrossEditingBoundary), listTag);
-    RefPtrWillBeRawPtr<HTMLElement> listElement = nullptr;
+    RefPtrWillBeRawPtr<HTMLElement> newListElementToBeInserted = nullptr;

[yosin_UTC9, 2016/01/12 05:51:44]

It seems renaming |listElement| to |lnewListElementToBeInserted| doesn't relate
to fix the bug.
Please have separate CL for renaming.

     if (previousList) {
         appendNode(listItemElement, previousList);
     } else if (nextList) {
         insertNodeAt(listItemElement, positionBeforeNode(nextList));
     } else {
         // Create the list.
-        listElement = createHTMLElement(document(), listTag);
-        appendNode(listItemElement, listElement);
+        newListElementToBeInserted = createHTMLElement(document(), listTag);
+        appendNode(listItemElement, newListElementToBeInserted);
 
         if (start.deepEquivalent() == end.deepEquivalent() && isEnclosingBlock(start.deepEquivalent().anchorNode())) {
             // Inserting the list into an empty paragraph that isn't held open
@@ -400,7 +411,7 @@ PassRefPtrWillBeRawPtr<HTMLElement> InsertListCommand::listifyParagraph(const Vi
         if (isHTMLLIElement(listChild))
             insertionPos = positionInParentBeforeNode(*listChild);
 
-        insertNodeAt(listElement, insertionPos);
+        insertNodeAt(newListElementToBeInserted, insertionPos);
 
         // We inserted the list at the start of the content we're about to move
         // Update the start of content, so we don't try to move the list into itself.  bug 19066
@@ -413,17 +424,17 @@ PassRefPtrWillBeRawPtr<HTMLElement> InsertListCommand::listifyParagraph(const Vi
     // Inserting list element and list item list may change start of pargraph
     // to move. We calculate start of paragraph again.
     document().updateLayoutIgnorePendingStylesheets();
-    start = startOfParagraph(start, CanSkipOverEditingBoundary);
-    end = endOfParagraph(start, CanSkipOverEditingBoundary);
-    moveParagraph(start, end, createVisiblePosition(positionBeforeNode(placeholder.get())), true);
+    const VisiblePosition paragraphStartToInsert = startOfParagraph(start, CanSkipOverEditingBoundary);

[yosin_UTC9, 2016/01/12 05:51:44]

nit: |const VisiblePosition&|
This is kind of renaming variables and not relate to fix the bug, please have a
separate CL.

+    moveParagraph(paragraphStartToInsert, endOfParagraph(paragraphStartToInsert, CanSkipOverEditingBoundary),
+        createVisiblePosition(positionBeforeNode(placeholder.get())), true);
 
-    if (listElement)
-        return mergeWithNeighboringLists(listElement);
+    if (newListElementToBeInserted)
+        return mergeWithNeighboringLists(newListElementToBeInserted);
 
     if (canMergeLists(previousList, nextList))
         mergeIdenticalElements(previousList, nextList);
 
-    return listElement;
+    return nullptr;
 }
 
 DEFINE_TRACE(InsertListCommand)