Changeset 275320 in webkit

Timestamp:

Mar 31, 2021, 4:38:30 PM (6 years ago)

Author:

commit-queue@webkit.org

Message:

Null pointer access crash in WebCore::makeBoundaryPoint(..)
​https://bugs.webkit.org/show_bug.cgi?id=223977

Patch by Venky Dass <​yaranamavenkataramana@apple.com> on 2021-03-31
Reviewed by Darin Adler.

Source/WebCore:

In makeBoundaryPoint, position.containerNode() can be nullptr even if position.isNull() was false

Test: LayoutTests/editing/inserting/crash-make-boundary-point.html

• dom/Position.cpp:

(WebCore::makeBoundaryPoint):

LayoutTests:

Adding a refression test case.

• editing/inserting/crash-make-boundary-point-expected.txt: Added.
• editing/inserting/crash-make-boundary-point.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/editing/inserting/crash-make-boundary-point-expected.txt (added)
• LayoutTests/editing/inserting/crash-make-boundary-point.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/dom/Position.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-03-31  Venky Dass  <yaranamavenkataramana@apple.com>
+
+        Null pointer access crash in WebCore::makeBoundaryPoint(..)
+        https://bugs.webkit.org/show_bug.cgi?id=223977
+
+        Reviewed by Darin Adler.
+
+        Adding a refression test case.
+
+        * editing/inserting/crash-make-boundary-point-expected.txt: Added.
+        * editing/inserting/crash-make-boundary-point.html: Added.
+
 2021-03-31  Chris Gambrell  <cgambrell@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-03-31  Venky Dass  <yaranamavenkataramana@apple.com>
+
+        Null pointer access crash in WebCore::makeBoundaryPoint(..)
+        https://bugs.webkit.org/show_bug.cgi?id=223977
+
+        Reviewed by Darin Adler.
+
+        In makeBoundaryPoint, position.containerNode() can be nullptr even if position.isNull() was false 
+
+        Test: LayoutTests/editing/inserting/crash-make-boundary-point.html
+
+        * dom/Position.cpp:
+        (WebCore::makeBoundaryPoint):
+
 2021-03-31  Eric Carlson  <eric.carlson@apple.com>
 

trunk/Source/WebCore/dom/Position.cpp

@@ -1595 +1595 @@
 Optional<BoundaryPoint> makeBoundaryPoint(const Position& position)
 {
-    if (position.isNull())
+    auto container = makeRefPtr(position.containerNode());
+    if (!container)
         return WTF::nullopt;
-    return BoundaryPoint { *position.containerNode(), static_cast<unsigned>(position.computeOffsetInContainerNode()) };
+    return BoundaryPoint { container.releaseNonNull(), static_cast<unsigned>(position.computeOffsetInContainerNode()) };
 }