Changeset 267706 in webkit

Timestamp:

Sep 28, 2020, 11:14:23 AM (6 years ago)

Author:

Darin Adler

Message:

REGRESSION (r267329): Crash due to null-dereference of frame pointer in DOMSelection::rangeCount
​https://bugs.webkit.org/show_bug.cgi?id=217053

Reviewed by Sam Weinig.

Later as a follow-up it would be nice to add a test case, but not obvious how to
make a simple one quickly.

• page/DOMSelection.cpp:

(WebCore::DOMSelection::rangeCount const): Fixed the null check.

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• page/DOMSelection.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2020-09-28  Darin Adler  <darin@apple.com>
+
+        REGRESSION (r267329): Crash due to null-dereference of frame pointer in DOMSelection::rangeCount
+        https://bugs.webkit.org/show_bug.cgi?id=217053
+
+        Reviewed by Sam Weinig.
+
+        Later as a follow-up it would be nice to add a test case, but not obvious how to
+        make a simple one quickly.
+
+        * page/DOMSelection.cpp:
+        (WebCore::DOMSelection::rangeCount const): Fixed the null check.
+
 2020-09-28  Aditya Keerthi  <akeerthi@apple.com>
 

trunk/Source/WebCore/page/DOMSelection.cpp

@@ -189 +189 @@
 {
     auto frame = this->frame();
-    if (frame->settings().liveRangeSelectionEnabled())
-        return frame && frame->selection().isInDocumentTree();
+    if (frame && frame->settings().liveRangeSelectionEnabled())
+        return frame->selection().isInDocumentTree();
     return !frame || frame->selection().isNone() ? 0 : 1;
 }