Changeset 203518 in webkit

Timestamp:

Jul 21, 2016, 12:41:47 PM (10 years ago)

Author:

rniwa@webkit.org

Message:

Crash accessing null renderer inside WebCore::DeleteSelectionCommand::doApply
​https://bugs.webkit.org/show_bug.cgi?id=160011

Reviewed by Chris Dumez.

Add a null pointer check for renderer() call.

Unfortunately no new tests since we don't have a reproduction.

• editing/DeleteSelectionCommand.cpp:

(WebCore::DeleteSelectionCommand::doApply):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• editing/DeleteSelectionCommand.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2016-07-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Crash accessing null renderer inside WebCore::DeleteSelectionCommand::doApply
+        https://bugs.webkit.org/show_bug.cgi?id=160011
+
+        Reviewed by Chris Dumez.
+
+        Add a null pointer check for renderer() call.
+
+        Unfortunately no new tests since we don't have a reproduction.
+
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::doApply):
+
 2016-07-21  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebCore/editing/DeleteSelectionCommand.cpp

@@ -865 +865 @@
         if (is<Text>(node)) {
             Text& textNode = downcast<Text>(*node);
-            if (textNode.length())
+            if (textNode.length() && textNode.renderer())
                 shouldRebalaceWhiteSpace = textNode.renderer()->style().textSecurity() == TSNONE;
         }