Changeset 202807 in webkit

Timestamp:

Jul 4, 2016 4:22:59 AM (8 years ago)

Author:

commit-queue@webkit.org

Message:

[GTK] Null WebCore::Range dereference in WebEditorClient::updateGlobalSelection
​https://bugs.webkit.org/show_bug.cgi?id=159341

Patch by Fujii Hironori <Fujii Hironori> on 2016-07-04
Reviewed by Carlos Garcia Campos.

FrameSelection::toNormalizedRange() can return null. Null check is
needed.

Tests:

editing/input/set-value-on-input-and-delete.html
editing/selection/selection-in-iframe-removed-crash.html
imported/w3c/web-platform-tests/html/semantics/embedded-content/the-img-element/sizes/parse-a-sizes-attribute.html
imported/w3c/web-platform-tests/html/semantics/forms/textfieldselection/selection-after-content-change.html
imported/w3c/web-platform-tests/html/semantics/forms/textfieldselection/selection-not-application-textarea.html
imported/w3c/web-platform-tests/html/semantics/forms/textfieldselection/selection-not-application.html

• WebProcess/WebCoreSupport/gtk/WebEditorClientGtk.cpp:

(WebKit::WebEditorClient::updateGlobalSelection): Do not update
global selection if FrameSelection::toNormalizedRange() returns
null.

Location:

trunk/Source/WebKit2

Files:

• ChangeLog (modified) (1 diff)
• WebProcess/WebCoreSupport/gtk/WebEditorClientGtk.cpp (modified) (2 diffs)

trunk/Source/WebKit2/ChangeLog

@@ +1 @@
+2016-07-04  Fujii Hironori  <Hironori.Fujii@sony.com>
+
+        [GTK] Null WebCore::Range dereference in WebEditorClient::updateGlobalSelection
+        https://bugs.webkit.org/show_bug.cgi?id=159341
+
+        Reviewed by Carlos Garcia Campos.
+
+        FrameSelection::toNormalizedRange() can return null. Null check is
+        needed.
+
+        Tests:
+            editing/input/set-value-on-input-and-delete.html
+            editing/selection/selection-in-iframe-removed-crash.html
+            imported/w3c/web-platform-tests/html/semantics/embedded-content/the-img-element/sizes/parse-a-sizes-attribute.html
+            imported/w3c/web-platform-tests/html/semantics/forms/textfieldselection/selection-after-content-change.html
+            imported/w3c/web-platform-tests/html/semantics/forms/textfieldselection/selection-not-application-textarea.html
+            imported/w3c/web-platform-tests/html/semantics/forms/textfieldselection/selection-not-application.html
+
+        * WebProcess/WebCoreSupport/gtk/WebEditorClientGtk.cpp:
+        (WebKit::WebEditorClient::updateGlobalSelection): Do not update
+        global selection if FrameSelection::toNormalizedRange() returns
+        null.
+
 2016-07-04  Fujii Hironori  <Hironori.Fujii@sony.com>
 

trunk/Source/WebKit2/WebProcess/WebCoreSupport/gtk/WebEditorClientGtk.cpp

@@ -166 +166 @@
     if (!frame->selection().isRange())
         return;
+    RefPtr<Range> range = frame->selection().toNormalizedRange();
+    if (!range)
+        return;
 
     frameSettingClipboard = frame;
@@ -175 +178 @@
     g_closure_set_marshal(callback.get(), g_cclosure_marshal_VOID__VOID);
 
-    RefPtr<Range> range = frame->selection().toNormalizedRange();
     PasteboardWebContent pasteboardContent;
     pasteboardContent.canSmartCopyOrDelete = false;