Check the traversal state in CompositeEditCommand::cloneParagraphUnderNewElement

Source/core/editing/CompositeEditCommand.cpp

 /*
  * Copyright (C) 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 946 matching lines @@
     if (anchorNode->inDocument())
         removeNodePreservingChildren(anchorNode);
 }
 
 // Clone the paragraph between start and end under blockElement,
 // preserving the hierarchy up to outerNode.
 
 void CompositeEditCommand::cloneParagraphUnderNewElement(const Position& start, const Position& end, Node* passedOuterNode, Element* blockElement)
 {
     ASSERT(comparePositions(start, end) <= 0);
+    ASSERT(passedOuterNode);
+    ASSERT(blockElement);
 
     // First we clone the outerNode
     RefPtr<Node> lastNode;
     RefPtr<Node> outerNode = passedOuterNode;
 
     if (outerNode->isRootEditableElement()) {
         lastNode = blockElement;
     } else {
         lastNode = outerNode->cloneNode(isRenderedTableElement(outerNode.get()));
         appendNode(lastNode, blockElement);
@@ skipping 21 matching lines @@
     if (!outerNode->inDocument())
         return;
 
     // Handle the case of paragraphs with more than one node,
     // cloning all the siblings until end.deprecatedNode() is reached.
 
     if (start.deprecatedNode() != end.deprecatedNode() && !start.deprecatedNode()->isDescendantOf(end.deprecatedNode())) {
         // If end is not a descendant of outerNode we need to
         // find the first common ancestor to increase the scope
         // of our nextSibling traversal.
-        while (!end.deprecatedNode()->isDescendantOf(outerNode.get())) {
+        while (outerNode && !end.deprecatedNode()->isDescendantOf(outerNode.get())) {
             outerNode = outerNode->parentNode();
         }
 
+        if (!outerNode)

[Yuta Kitamura, 2014/04/28 02:56:42]

In what situation this could happen? (I really couldn't trace
what this function is doing...)

Or better yet, you could possibly replace lines 1010-1012 with
Node::commonAncestor()?

[yoichio, 2014/04/30 07:45:17]

It takes place when |passedOuterNode| and |end| are not in a same DOM tree.

+            return;
+
         RefPtr<Node> startNode = start.deprecatedNode();
         for (RefPtr<Node> node = NodeTraversal::nextSkippingChildren(*startNode, outerNode.get()); node; node = NodeTraversal::nextSkippingChildren(*node, outerNode.get())) {
             // Move lastNode up in the tree as much as node was moved up in the
             // tree by NodeTraversal::nextSkippingChildren, so that the relative depth between
             // node and the original start node is maintained in the clone.
-            while (startNode->parentNode() != node->parentNode()) {
+            while (startNode && lastNode && startNode->parentNode() != node->parentNode()) {
                 startNode = startNode->parentNode();
                 lastNode = lastNode->parentNode();
             }
 
+            if (!lastNode || !lastNode->parentNode())

[Yuta Kitamura, 2014/04/28 02:56:42]

What's the point of checking the non-nullness of
lastNode->parentNode()?

[yoichio, 2014/04/30 07:45:17]

It is for L1031:insertNodeAfter(clonedNode, lastNode).
insertNodeAfter inserts |clonedNode| to the parent of |lastNode| as a last
child.

+                return;
+
             RefPtr<Node> clonedNode = node->cloneNode(true);
             insertNodeAfter(clonedNode, lastNode);
             lastNode = clonedNode.release();
             if (node == end.deprecatedNode() || end.deprecatedNode()->isDescendantOf(node.get()))
                 break;
         }
     }
 }
 
 
@@ skipping 428 matching lines @@
     return node.release();
 }
 
 PassRefPtr<Element> createBlockPlaceholderElement(Document& document)
 {
     RefPtr<Element> breakNode = document.createElement(brTag, false);
     return breakNode.release();
 }
 
 } // namespace WebCore