Changeset 255113 in webkit

Timestamp:

Jan 24, 2020 5:37:20 PM (4 years ago)

Author:

commit-queue@webkit.org

Message:

Null Ptr Deref READ @ WebCore::RenderMultiColumnFlow::lastMultiColumnSet const
​https://bugs.webkit.org/show_bug.cgi?id=206106

Patch by Jack Lee <Jack Lee> on 2020-01-24
Reviewed by Ryosuke Niwa.

Could not write a reproducible fast test case for this.

• rendering/RenderMultiColumnFlow.cpp:

(WebCore::RenderMultiColumnFlow::lastMultiColumnSet const):

• rendering/updating/RenderTreeBuilderMultiColumn.cpp:

(WebCore::RenderTreeBuilder::MultiColumn::processPossibleSpannerDescendant):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• rendering/RenderMultiColumnFlow.cpp (modified) (1 diff)
• rendering/updating/RenderTreeBuilderMultiColumn.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2020-01-24  Jack Lee  <shihchieh_lee@apple.com>
+
+        Null Ptr Deref READ @ WebCore::RenderMultiColumnFlow::lastMultiColumnSet const
+        https://bugs.webkit.org/show_bug.cgi?id=206106
+
+        Reviewed by Ryosuke Niwa.
+
+        Could not write a reproducible fast test case for this.
+
+        * rendering/RenderMultiColumnFlow.cpp:
+        (WebCore::RenderMultiColumnFlow::lastMultiColumnSet const):
+        * rendering/updating/RenderTreeBuilderMultiColumn.cpp:
+        (WebCore::RenderTreeBuilder::MultiColumn::processPossibleSpannerDescendant):
+
 2020-01-24  Wenson Hsieh  <wenson_hsieh@apple.com>
 

trunk/Source/WebCore/rendering/RenderMultiColumnFlow.cpp

@@ -75 +75 @@
 RenderMultiColumnSet* RenderMultiColumnFlow::lastMultiColumnSet() const
 {
+    ASSERT(multiColumnBlockFlow());
+
     for (RenderObject* sibling = multiColumnBlockFlow()->lastChild(); sibling; sibling = sibling->previousSibling()) {
         if (is<RenderMultiColumnSet>(*sibling))

trunk/Source/WebCore/rendering/updating/RenderTreeBuilderMultiColumn.cpp

@@ -282 +282 @@
     RenderObject* insertBeforeMulticolChild = nullptr;
     RenderObject* nextDescendant = &descendant;
+
+    if (!multicolContainer)
+        return nullptr;
 
     if (isValidColumnSpanner(flow, descendant)) {