Merge 158727 "Protect DOM nodes in IndentOutdentCommand::tryInde..."

Source/core/editing/IndentOutdentCommand.cpp

 /*
  * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 35 matching lines @@
 IndentOutdentCommand::IndentOutdentCommand(Document* document, EIndentType typeOfAction, int marginInPixels)
     : ApplyBlockElementCommand(document, blockquoteTag, "margin: 0 0 0 40px; border: none; padding: 0px;")
     , m_typeOfAction(typeOfAction)
     , m_marginInPixels(marginInPixels)
 {
 }
 
 bool IndentOutdentCommand::tryIndentingAsListItem(const Position& start, const Position& end)
 {
     // If our selection is not inside a list, bail out.
-    Node* lastNodeInSelectedParagraph = start.deprecatedNode();
-    RefPtr<Element> listNode = enclosingList(lastNodeInSelectedParagraph);
+    RefPtr<Node> lastNodeInSelectedParagraph = start.deprecatedNode();
+    RefPtr<Element> listNode = enclosingList(lastNodeInSelectedParagraph.get());
     if (!listNode)
         return false;
 
     // Find the block that we want to indent.  If it's not a list item (e.g., a div inside a list item), we bail out.
-    Element* selectedListItem = enclosingBlock(lastNodeInSelectedParagraph);
+    RefPtr<Element> selectedListItem = enclosingBlock(lastNodeInSelectedParagraph.get());
 
     // FIXME: we need to deal with the case where there is no li (malformed HTML)
     if (!selectedListItem->hasTagName(liTag))
         return false;
 
     // FIXME: previousElementSibling does not ignore non-rendered content like <span></span>.  Should we?
-    Element* previousList = selectedListItem->previousElementSibling();
-    Element* nextList = selectedListItem->nextElementSibling();
+    RefPtr<Element> previousList = selectedListItem->previousElementSibling();
+    RefPtr<Element> nextList = selectedListItem->nextElementSibling();
 
     RefPtr<Element> newList = document()->createElement(listNode->tagQName(), false);
-    insertNodeBefore(newList, selectedListItem);
+    insertNodeBefore(newList, selectedListItem.get());
 
-    moveParagraphWithClones(start, end, newList.get(), selectedListItem);
+    moveParagraphWithClones(start, end, newList.get(), selectedListItem.get());
 
-    if (canMergeLists(previousList, newList.get()))
-        mergeIdenticalElements(previousList, newList);
-    if (canMergeLists(newList.get(), nextList))
-        mergeIdenticalElements(newList, nextList);
+    if (canMergeLists(previousList.get(), newList.get()))
+        mergeIdenticalElements(previousList.get(), newList.get());
+    if (canMergeLists(newList.get(), nextList.get()))
+        mergeIdenticalElements(newList.get(), nextList.get());
 
     return true;
 }
 
 void IndentOutdentCommand::indentIntoBlockquote(const Position& start, const Position& end, RefPtr<Element>& targetBlockquote)
 {
     Node* enclosingCell = enclosingNodeOfType(start, &isTableCell);
     Node* nodeToSplitTo;
     if (enclosingCell)
         nodeToSplitTo = enclosingCell;
@@ skipping 136 matching lines @@
 
 void IndentOutdentCommand::formatRange(const Position& start, const Position& end, const Position&, RefPtr<Element>& blockquoteForNextIndent)
 {
     if (tryIndentingAsListItem(start, end))
         blockquoteForNextIndent = 0;
     else
         indentIntoBlockquote(start, end, blockquoteForNextIndent);
 }
 
 }