From fd949ee3ddb7776b53638c3d54f6325f4247abaf Mon Sep 17 00:00:00 2001
From: Jelle Raaijmakers <jelle@ladybird.org>
Date: Fri, 6 Dec 2024 16:32:20 +0100
Subject: [PATCH] LibWeb: Only set selection focus if an associated DOM node
 was found

The relation from a paintable to a DOM node is not always set.
---
 Libraries/LibWeb/Page/EventHandler.cpp        |  3 +--
 ...on-in-contenteditable-crash-regression.txt |  1 +
 ...n-in-contenteditable-crash-regression.html | 19 +++++++++++++++++++
 3 files changed, 21 insertions(+), 2 deletions(-)
 create mode 100644 Tests/LibWeb/Text/expected/Editing/selection-in-contenteditable-crash-regression.txt
 create mode 100644 Tests/LibWeb/Text/input/Editing/selection-in-contenteditable-crash-regression.html

diff --git a/Libraries/LibWeb/Page/EventHandler.cpp b/Libraries/LibWeb/Page/EventHandler.cpp
index eb00525694a..71a3282c0bb 100644
--- a/Libraries/LibWeb/Page/EventHandler.cpp
+++ b/Libraries/LibWeb/Page/EventHandler.cpp
@@ -596,9 +596,8 @@ EventResult EventHandler::handle_mousemove(CSSPixelPoint viewport_position, CSSP
         if (m_in_mouse_selection) {
             auto hit = paint_root()->hit_test(viewport_position, Painting::HitTestType::TextCursor);
             if (m_mouse_selection_target) {
-                if (hit.has_value()) {
+                if (hit.has_value() && hit->paintable->dom_node())
                     m_mouse_selection_target->set_selection_focus(*hit->paintable->dom_node(), hit->index_in_node);
-                }
             } else {
                 if (start_index.has_value() && hit.has_value() && hit->dom_node()) {
                     if (auto selection = document.get_selection()) {
diff --git a/Tests/LibWeb/Text/expected/Editing/selection-in-contenteditable-crash-regression.txt b/Tests/LibWeb/Text/expected/Editing/selection-in-contenteditable-crash-regression.txt
new file mode 100644
index 00000000000..6b793fa0b85
--- /dev/null
+++ b/Tests/LibWeb/Text/expected/Editing/selection-in-contenteditable-crash-regression.txt
@@ -0,0 +1 @@
+PASS (did not crash)
\ No newline at end of file
diff --git a/Tests/LibWeb/Text/input/Editing/selection-in-contenteditable-crash-regression.html b/Tests/LibWeb/Text/input/Editing/selection-in-contenteditable-crash-regression.html
new file mode 100644
index 00000000000..fd4d25ad364
--- /dev/null
+++ b/Tests/LibWeb/Text/input/Editing/selection-in-contenteditable-crash-regression.html
@@ -0,0 +1,19 @@
+<script src="../include.js"></script>
+<style>
+    div {
+        font-size: 10px;
+    }
+</style>
+<div contenteditable="true">a<br><br><div id="b">b</div></div>
+<script>
+    test(() => {
+        var bDiv = document.querySelector('div#b');
+        var bBounds = bDiv.getBoundingClientRect();
+
+        // Drag a selection from inside the #b div to just above it.
+        internals.mouseDown(bBounds.x + 2, bBounds.y + 5);
+        internals.movePointerTo(bBounds.x + 2, bBounds.y - 5);
+
+        println('PASS (did not crash)');
+    });
+</script>