Changeset 259766 in webkit

Timestamp:

Apr 8, 2020 4:59:31 PM (4 years ago)

Author:

Wenson Hsieh

Message:

REGRESSION (r258525): Occasional crashes under TextManipulationController::observeParagraphs
​https://bugs.webkit.org/show_bug.cgi?id=210215
<rdar://problem/61362512>

Reviewed by Darin Adler.

In the case where startOfParagraph or endOfParagraph return a null Position, we end up crashing under
TextManipulationController::observeParagraphs while creating ParagraphContentIterator, which expects non-null
Positions because it dereferences the result of makeBoundaryPoint.

Avoid this crash for now by bailing if either the start or end positions are null. Tests to be added in a
followup patch.

• editing/TextManipulationController.cpp:

(WebCore::TextManipulationController::observeParagraphs):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• editing/TextManipulationController.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2020-04-08  Wenson Hsieh  <wenson_hsieh@apple.com>
+
+        REGRESSION (r258525): Occasional crashes under TextManipulationController::observeParagraphs
+        https://bugs.webkit.org/show_bug.cgi?id=210215
+        <rdar://problem/61362512>
+
+        Reviewed by Darin Adler.
+
+        In the case where `startOfParagraph` or `endOfParagraph` return a null `Position`, we end up crashing under
+        TextManipulationController::observeParagraphs while creating `ParagraphContentIterator`, which expects non-null
+        `Position`s because it dereferences the result of `makeBoundaryPoint`.
+
+        Avoid this crash for now by bailing if either the start or end positions are null. Tests to be added in a
+        followup patch.
+
+        * editing/TextManipulationController.cpp:
+        (WebCore::TextManipulationController::observeParagraphs):
+
 2020-04-08  Kenneth Russell  <kbr@chromium.org>
 

trunk/Source/WebCore/editing/TextManipulationController.cpp

@@ -240 +240 @@
 void TextManipulationController::observeParagraphs(const Position& start, const Position& end)
 {
+    if (start.isNull() || end.isNull())
+        return;
+
     auto document = makeRefPtr(start.document());
     ASSERT(document);