Changeset 63545 in webkit

Timestamp:

Jul 16, 2010 7:07:35 AM (14 years ago)

Author:

commit-queue@webkit.org

Message:

2010-07-16 Andrey Kosyakov <​caseq@chromium.org>

Reviewed by Pavel Feldman.

Check that end node of a range has a valid renderer in WebViewImpl::caretOrSelectionBounds()
to avoid crash in Position::getInlineBoxAndOffset() when start node has renderer but end one doesn't.
​https://bugs.webkit.org/show_bug.cgi?id=42449

• src/WebViewImpl.cpp: (WebKit::WebViewImpl::caretOrSelectionBounds):

Location:

trunk/WebKit/chromium

Files:

• ChangeLog (modified) (1 diff)
• src/WebViewImpl.cpp (modified) (1 diff)

trunk/WebKit/chromium/ChangeLog

@@ +1 @@
+2010-07-16  Andrey Kosyakov  <caseq@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Check that end node of a range has a valid renderer in WebViewImpl::caretOrSelectionBounds()
+        to avoid crash in Position::getInlineBoxAndOffset() when start node has renderer but end one doesn't.
+        https://bugs.webkit.org/show_bug.cgi?id=42449
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::caretOrSelectionBounds):
+
 2010-07-16  Mikhail Naganov  <mnaganov@chromium.org>
 

trunk/WebKit/chromium/src/WebViewImpl.cpp

@@ -1246 +1246 @@
         rect = view->contentsToWindow(controller->absoluteCaretBounds());
     else if (controller->isRange()) {
+        node = controller->end().node();
+        if (!node || !node->renderer())
+            return rect;
         RefPtr<Range> range = controller->toNormalizedRange();
         rect = view->contentsToWindow(focused->firstRectForRange(range.get()));