Changeset 247369 in webkit

Timestamp:

Jul 11, 2019 3:22:57 PM (5 years ago)

Author:

timothy_horton@apple.com

Message:

Null deref of Range under WebPage::startAutoscrollAtPosition
​https://bugs.webkit.org/show_bug.cgi?id=199724
<rdar://problem/41127089>

Reviewed by Dean Jackson.

• WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::WebPage::startAutoscrollAtPosition):
Refactor this function to be early-return-y, and add one more
early return if the Range is null.

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• WebProcess/WebPage/ios/WebPageIOS.mm (modified) (1 diff)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2019-07-11  Tim Horton  <timothy_horton@apple.com>
+
+        Null deref of Range under WebPage::startAutoscrollAtPosition
+        https://bugs.webkit.org/show_bug.cgi?id=199724
+        <rdar://problem/41127089>
+
+        Reviewed by Dean Jackson.
+
+        * WebProcess/WebPage/ios/WebPageIOS.mm:
+        (WebKit::WebPage::startAutoscrollAtPosition):
+        Refactor this function to be early-return-y, and add one more
+        early return if the Range is null.
+
 2019-07-11  Pablo Saavedra  <psaavedra@igalia.com>
 

trunk/Source/WebKit/WebProcess/WebPage/ios/WebPageIOS.mm

@@ -1764 +1764 @@
 void WebPage::startAutoscrollAtPosition(const WebCore::FloatPoint& positionInWindow)
 {
-    if (m_focusedElement && m_focusedElement->renderer())
+    if (m_focusedElement && m_focusedElement->renderer()) {
         m_page->mainFrame().eventHandler().startSelectionAutoscroll(m_focusedElement->renderer(), positionInWindow);
-    else {
-        Frame& frame = m_page->focusController().focusedOrMainFrame();
-        VisibleSelection selection = frame.selection().selection();
-        if (selection.isRange()) {
-            RefPtr<Range> range = frame.selection().toNormalizedRange();
-            Node& node = range->startContainer();
-            auto* renderer = node.renderer();
-            if (renderer)
-                m_page->mainFrame().eventHandler().startSelectionAutoscroll(renderer, positionInWindow);
-        }
-    }
+        return;
+    }
+    
+    Frame& frame = m_page->focusController().focusedOrMainFrame();
+    VisibleSelection selection = frame.selection().selection();
+    if (!selection.isRange())
+        return;
+    RefPtr<Range> range = frame.selection().toNormalizedRange();
+    if (!range)
+        return;
+    auto* renderer = range->startContainer().renderer();
+    if (!renderer)
+        return;
+
+    m_page->mainFrame().eventHandler().startSelectionAutoscroll(renderer, positionInWindow);
 }