Changeset 271451 in webkit

Timestamp:

Jan 13, 2021, 1:04:12 PM (6 years ago)

Author:

commit-queue@webkit.org

Message:

Null check selector.argumentList()
​https://bugs.webkit.org/show_bug.cgi?id=220392

Patch by Rob Buis <​rbuis@igalia.com> on 2021-01-13
Reviewed by Wenson Hsieh.

Source/WebCore:

Null check selector.argumentList().

Test: highlight/highlight-crash.html

• css/SelectorChecker.cpp:

(WebCore::SelectorChecker::checkOne const):

LayoutTests:

Add test that triggers the relevant code path.

• highlight/highlight-crash-expected.txt: Added.
• highlight/highlight-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/highlight/highlight-crash-expected.txt (added)
• LayoutTests/highlight/highlight-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/css/SelectorChecker.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-01-13  Rob Buis  <rbuis@igalia.com>
+
+        Null check selector.argumentList()
+        https://bugs.webkit.org/show_bug.cgi?id=220392
+
+        Reviewed by Wenson Hsieh.
+
+        Add test that triggers the relevant code path.
+
+        * highlight/highlight-crash-expected.txt: Added.
+        * highlight/highlight-crash.html: Added.
+
 2021-01-13  Antti Koivisto  <antti@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-01-13  Rob Buis  <rbuis@igalia.com>
+
+        Null check selector.argumentList()
+        https://bugs.webkit.org/show_bug.cgi?id=220392
+
+        Reviewed by Wenson Hsieh.
+
+        Null check selector.argumentList().
+
+        Test: highlight/highlight-crash.html
+
+        * css/SelectorChecker.cpp:
+        (WebCore::SelectorChecker::checkOne const):
+
 2021-01-13  Ziran Sun  <zsun@igalia.com>
 

trunk/Source/WebCore/css/SelectorChecker.cpp

@@ -1144 +1144 @@
             if (checkingContext.pseudoId == PseudoId::None)
                 return true;
-            if (checkingContext.pseudoId != PseudoId::Highlight)
+            if (checkingContext.pseudoId != PseudoId::Highlight || !selector.argumentList())
                 return false;
             return selector.argumentList()->first() == checkingContext.nameForHightlightPseudoElement;