Changeset 224296 in webkit

Timestamp:

Nov 1, 2017 2:26:33 PM (6 years ago)

Author:

rniwa@webkit.org

Message:

innerText->renderBox() can be null in HTMLTextFormControlElement::setSelectionRange
​https://bugs.webkit.org/show_bug.cgi?id=179103

Reviewed by Antti Koivisto.

Added a missing null check.

Unfortunately, no new tests since we don't have a working reproduction for trunk code.

• html/HTMLTextFormControlElement.cpp:

(WebCore::HTMLTextFormControlElement::setSelectionRange): Added a null check.

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• html/HTMLTextFormControlElement.cpp (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2017-11-01  Ryosuke Niwa  <rniwa@webkit.org>
+
+        innerText->renderBox() can be null in HTMLTextFormControlElement::setSelectionRange
+        https://bugs.webkit.org/show_bug.cgi?id=179103
+
+        Reviewed by Antti Koivisto.
+
+        Added a missing null check.
+
+        Unfortunately, no new tests since we don't have a working reproduction for trunk code.
+
+        * html/HTMLTextFormControlElement.cpp:
+        (WebCore::HTMLTextFormControlElement::setSelectionRange): Added a null check.
+
 2017-11-01  Brady Eidson  <beidson@apple.com>
 

trunk/Source/WebCore/html/HTMLTextFormControlElement.cpp

@@ -294 +294 @@
     bool hasFocus = document().focusedElement() == this;
     if (!hasFocus && innerText) {
-        // FIXME: Removing this synchronous layout requires fixing <https://webkit.org/b/128797>
+        // FIXME: Removing this synchronous layout requires fixing setSelectionWithoutUpdatingAppearance not needing up-to-date style.
         document().updateLayoutIgnorePendingStylesheets();
 
@@ -302 +302 @@
 
         if (innerText && rendererTextControl) {
-            if (rendererTextControl->style().visibility() == HIDDEN || !innerText->renderBox()->height()) {
+            if (rendererTextControl->style().visibility() == HIDDEN || !innerText->renderBox() || !innerText->renderBox()->height()) {
                 cacheSelection(start, end, direction);
                 return;