Changeset 202757 in webkit

Timestamp:

Jul 1, 2016 1:59:08 PM (8 years ago)

Author:

Chris Dumez

Message:

[iOS] Possible null Range dereference under computeAutocorrectionContext()
​https://bugs.webkit.org/show_bug.cgi?id=159328
<rdar://problem/26766720>

Reviewed by Benjamin Poulain.

Source/WebCore:

• editing/Editor.cpp:

(WebCore::Editor::compositionRange):

• editing/Editor.h:

Update to return a RefPtr instead of a PassRefPtr and use nullptr
instead of 0 in the implementation.

Source/WebKit2:

The code in computeAutocorrectionContext() was checking Editor::hasComposition()
before dereferencing Editor::compositionRange(). However, compositionRange()
can also return null in other cases (e.g. compositionStart == compositionEnd).

Drop the check for hasComposition() and do a null check on the value returned
by compositionRange() instead.

• WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::computeAutocorrectionContext):

Location:

trunk/Source

Files:

• WebCore/ChangeLog (modified) (1 diff)
• WebCore/editing/Editor.cpp (modified) (1 diff)
• WebCore/editing/Editor.h (modified) (1 diff)
• WebKit2/ChangeLog (modified) (1 diff)
• WebKit2/WebProcess/WebPage/ios/WebPageIOS.mm (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2016-07-01  Chris Dumez  <cdumez@apple.com>
+
+        [iOS] Possible null Range dereference under computeAutocorrectionContext()
+        https://bugs.webkit.org/show_bug.cgi?id=159328
+        <rdar://problem/26766720>
+
+        Reviewed by Benjamin Poulain.
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::compositionRange):
+        * editing/Editor.h:
+        Update to return a RefPtr instead of a PassRefPtr and use nullptr
+        instead of 0 in the implementation.
+
 2016-07-01  Jon Davis  <jond@apple.com>
 

trunk/Source/WebCore/editing/Editor.cpp

@@ -2824 +2824 @@
 }
 
-PassRefPtr<Range> Editor::compositionRange() const
+RefPtr<Range> Editor::compositionRange() const
 {
     if (!m_compositionNode)
-        return 0;
+        return nullptr;
     unsigned length = m_compositionNode->length();
     unsigned start = std::min(m_compositionStart, length);
     unsigned end = std::min(std::max(start, m_compositionEnd), length);
     if (start >= end)
-        return 0;
+        return nullptr;
     return Range::create(m_compositionNode->document(), m_compositionNode.get(), start, m_compositionNode.get(), end);
 }

trunk/Source/WebCore/editing/Editor.h

@@ -305 +305 @@
     WEBCORE_EXPORT void cancelComposition();
     bool cancelCompositionIfSelectionIsInvalid();
-    WEBCORE_EXPORT PassRefPtr<Range> compositionRange() const;
+    WEBCORE_EXPORT RefPtr<Range> compositionRange() const;
     WEBCORE_EXPORT bool getCompositionSelection(unsigned& selectionStart, unsigned& selectionEnd) const;
 

trunk/Source/WebKit2/ChangeLog

@@ +1 @@
+2016-07-01  Chris Dumez  <cdumez@apple.com>
+
+        [iOS] Possible null Range dereference under computeAutocorrectionContext()
+        https://bugs.webkit.org/show_bug.cgi?id=159328
+        <rdar://problem/26766720>
+
+        Reviewed by Benjamin Poulain.
+
+        The code in computeAutocorrectionContext() was checking Editor::hasComposition()
+        before dereferencing Editor::compositionRange(). However, compositionRange()
+        can also return null in other cases (e.g. compositionStart == compositionEnd).
+
+        Drop the check for hasComposition() and do a null check on the value returned
+        by compositionRange() instead.
+
+        * WebProcess/WebPage/ios/WebPageIOS.mm:
+        (WebKit::computeAutocorrectionContext):
+
 2016-07-01  Brent Fulgham  <bfulgham@apple.com>
 

trunk/Source/WebKit2/WebProcess/WebPage/ios/WebPageIOS.mm

@@ -2192 +2192 @@
         selectedText = plainTextReplacingNoBreakSpace(frame.selection().selection().toNormalizedRange().get());
 
-    if (frame.editor().hasComposition()) {
-        range = Range::create(*frame.document(), frame.editor().compositionRange()->startPosition(), startPosition);
+    if (auto compositionRange = frame.editor().compositionRange()) {
+        range = Range::create(*frame.document(), compositionRange->startPosition(), startPosition);
         String markedTextBefore;
         if (range)
             markedTextBefore = plainTextReplacingNoBreakSpace(range.get());
-        range = Range::create(*frame.document(), endPosition, frame.editor().compositionRange()->endPosition());
+        range = Range::create(*frame.document(), endPosition, compositionRange->endPosition());
         String markedTextAfter;
         if (range)