Changeset 199807 in webkit

Timestamp:

Apr 20, 2016 10:02:23 PM (8 years ago)

Author:

Chris Dumez

Message:

Crash under WebCore::TextIterator::subrange()
​https://bugs.webkit.org/show_bug.cgi?id=156809
<rdar://problem/21102730>

Reviewed by Ryosuke Niwa.

TextIterator::rangeFromLocationAndLength() may return null. However, we
failed to do a null check before calling TextIterator::subrange() with
that range.

No new tests, do not know how to reproduce.

• editing/AlternativeTextController.cpp:

(WebCore::AlternativeTextController::applyAlternativeTextToRange):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• editing/AlternativeTextController.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2016-04-20  Chris Dumez  <cdumez@apple.com>
+
+        Crash under WebCore::TextIterator::subrange()
+        https://bugs.webkit.org/show_bug.cgi?id=156809
+        <rdar://problem/21102730>
+
+        Reviewed by Ryosuke Niwa.
+
+        TextIterator::rangeFromLocationAndLength() may return null. However, we
+        failed to do a null check before calling TextIterator::subrange() with
+        that range.
+
+        No new tests, do not know how to reproduce.
+
+        * editing/AlternativeTextController.cpp:
+        (WebCore::AlternativeTextController::applyAlternativeTextToRange):
+
 2016-04-20  Brady Eidson  <beidson@apple.com>
 

trunk/Source/WebCore/editing/AlternativeTextController.cpp

@@ -274 +274 @@
     // Recalculate pragraphRangeContainingCorrection, since SpellingCorrectionCommand modified the DOM, such that the original paragraphRangeContainingCorrection is no longer valid. Radar: 10305315 Bugzilla: 89526
     paragraphRangeContainingCorrection = TextIterator::rangeFromLocationAndLength(&rootNode, paragraphStartIndex, correctionStartOffsetInParagraph + alternative.length());
+    if (!paragraphRangeContainingCorrection)
+        return;
     
     setEnd(paragraphRangeContainingCorrection.get(), m_frame.selection().selection().start());