Add null check to fix crash in blink::ComputedStyle::display

third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommand.cpp

Index: third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommand.cpp
diff --git a/third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommand.cpp b/third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommand.cpp
index 2e6cbfa271035e812a5830f1702a98365fe032e6..ca6467be27552fa88fcc9491c38f31fa0744100c 100644
--- a/third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommand.cpp
+++ b/third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommand.cpp
@@ -794,14 +794,28 @@ static void removeHeadContents(ReplacementFragment& fragment)
     }
 }
 
+static bool isListItemStyle(const HTMLElement& element)

[yosin_UTC9, 2016/07/12 01:30:36]

Can make |isListItem()| in "EditingUtilitis.h" to use computed style and use it
here?

[joone, 2016/07/12 23:08:54]

Done.

+{
+    if (element.computedStyle() && element.computedStyle()->display() == LIST_ITEM)

[yosin_UTC9, 2016/07/12 01:30:36]

nit: We should avoid to use |return true| with |return false|

const ComputedStyle* style = element.computedStyle();
return style && style->display() == LIST_ITEM;

[joone, 2016/07/12 23:08:54]

Done.

+        return true;
+    return false;
+}
+
+static bool isTableCellStyle(const HTMLElement& element)

[yosin_UTC9, 2016/07/12 01:30:36]

Can make |isTableCell()| in "EditingUtilitis.h" to use computed style and use it
here?

[joone, 2016/07/12 23:08:54]

Done.

+{
+    if (element.computedStyle() && element.computedStyle()->display() == TABLE_CELL)

[yosin_UTC9, 2016/07/12 01:30:36]

nit: We should avoid to use |return true| with |return false|

const ComputedStyle* style = element.computedStyle();
return style && style->display() == LIST_ITEM;

[joone, 2016/07/12 23:08:54]

Done.

+        return true;
+    return false;
+}
+
 static bool followBlockElementStyle(const Node* node)
 {
     if (!node->isHTMLElement())
         return false;
 

[yosin_UTC9, 2016/07/12 01:30:36]

I think computedStyle() should not be return nullptr, but current implementation
returns nullptr.
I guess this situation is changed by "Splitting up Style Resolution and Layout
Tree Construction"
https://groups.google.com/a/chromium.org/forum/#!searchin/blink-dev/style$20t...


It seems null-pointer reference is occurred at L834 of
handleStyleSpansBeforeInsertion() instead of here:

834 if (node->computedStyle()->display() == INLINE) {
        node = enclosingBlock(insertionPos.anchorNode());
        if (!node)
            return false;
    }

    if (followBlockElementStyle(node)) {
        fragment.removeNodePreservingChildren(wrappingStyleSpan);
        return true;
    }

[joone, 2016/07/12 23:08:54]

We can use isInline() function defined in EditingUtilities.cpp

     const HTMLElement& element = toHTMLElement(*node);
-    return element.computedStyle()->display() == LIST_ITEM
-        || element.computedStyle()->display() == TABLE_CELL
+    return isListItemStyle(element)
+        || isTableCellStyle(element)
         || element.hasTagName(preTag)
         || element.hasTagName(h1Tag)
         || element.hasTagName(h2Tag)