Changeset 201583 in webkit

Timestamp:

Jun 1, 2016, 6:09:55 PM (10 years ago)

Author:

Chris Dumez

Message:

[iOS] Regression(r200972): Crash under WebKit::WebPage::selectTextWithGranularityAtPoint()
​https://bugs.webkit.org/show_bug.cgi?id=158284
<rdar://problem/26573954>

Reviewed by Ryosuke Niwa.

range can be null but r200972 started dereferencing it without null
check. This patch adds a null check for range and uses the pre-r200972
code path if range is null.

• WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::WebPage::selectTextWithGranularityAtPoint):

Location:

trunk/Source/WebKit2

Files:

• ChangeLog (modified) (1 diff)
• WebProcess/WebPage/ios/WebPageIOS.mm (modified) (1 diff)

trunk/Source/WebKit2/ChangeLog

@@ +1 @@
+2016-06-01  Chris Dumez  <cdumez@apple.com>
+
+        [iOS] Regression(r200972): Crash under WebKit::WebPage::selectTextWithGranularityAtPoint()
+        https://bugs.webkit.org/show_bug.cgi?id=158284
+        <rdar://problem/26573954>
+
+        Reviewed by Ryosuke Niwa.
+
+        range can be null but r200972 started dereferencing it without null
+        check. This patch adds a null check for range and uses the pre-r200972
+        code path if range is null.
+
+        * WebProcess/WebPage/ios/WebPageIOS.mm:
+        (WebKit::WebPage::selectTextWithGranularityAtPoint):
+
 2016-06-01  Brady Eidson  <beidson@apple.com>
 

trunk/Source/WebKit2/WebProcess/WebPage/ios/WebPageIOS.mm

@@ -1876 +1876 @@
         m_blockSelectionDesiredSize.setHeight(blockSelectionStartHeight);
         m_currentBlockSelection = nullptr;
-        auto* renderer = range->startContainer().renderer();
-        if (renderer->style().preserveNewline())
+        auto* renderer = range ? range->startContainer().renderer() : nullptr;
+        if (renderer && renderer->style().preserveNewline())
             m_blockRectForTextSelection = renderer->absoluteBoundingBoxRect(true);
         else {