Changeset 84320 in webkit

Timestamp:

Apr 19, 2011 5:23:51 PM (13 years ago)

Author:

rniwa@webkit.org

Message:

2011-04-19 Ryosuke Niwa <​rniwa@webkit.org>

Reviewed by Ojan Vafai.

REGRESSION(r83967): Crash in selectionExtentRespectingEditingBoundary
​https://bugs.webkit.org/show_bug.cgi?id=58910

The crash was caused by selectionExtentRespectingEditingBoundary's incorrectly assuming that
targetNode always have renderer when there selection has an editable root and the target node
is outside of the editable root.

Fixed the bug by adding an early exit when the target node is null.

No new tests are added since we don't have a reduction for this crash.

• page/EventHandler.cpp: (WebCore::selectionExtentRespectingEditingBoundary):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• page/EventHandler.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-04-19  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Ojan Vafai.
+
+        REGRESSION(r83967): Crash in selectionExtentRespectingEditingBoundary
+        https://bugs.webkit.org/show_bug.cgi?id=58910
+
+        The crash was caused by selectionExtentRespectingEditingBoundary's incorrectly assuming that
+        targetNode always have renderer when there selection has an editable root and the target node
+        is outside of the editable root.
+        
+        Fixed the bug by adding an early exit when the target node is null.
+
+        No new tests are added since we don't have a reduction for this crash.
+
+        * page/EventHandler.cpp:
+        (WebCore::selectionExtentRespectingEditingBoundary):
+
 2011-04-19  Geoffrey Garen  <ggaren@apple.com>
 

trunk/Source/WebCore/page/EventHandler.cpp

@@ -627 +627 @@
     IntPoint selectionEndPoint = localPoint;
     Element* editableElement = selection.rootEditableElement();
-    Node* selectionEndNode = targetNode;
+
+    if (!targetNode->renderer())
+        return VisiblePosition();
 
     if (editableElement && !editableElement->contains(targetNode)) {
-        selectionEndNode = editableElement;
-
-        if (!selectionEndNode->renderer())
+        if (!editableElement->renderer())
             return VisiblePosition();
 
         FloatPoint absolutePoint = targetNode->renderer()->localToAbsolute(FloatPoint(selectionEndPoint));
-        selectionEndPoint = roundedIntPoint(selectionEndNode->renderer()->absoluteToLocal(absolutePoint));
-    }
-
-    if (!selectionEndNode->renderer())
-        return VisiblePosition();
-
-    return selectionEndNode->renderer()->positionForPoint(selectionEndPoint);
+        selectionEndPoint = roundedIntPoint(editableElement->renderer()->absoluteToLocal(absolutePoint));
+        targetNode = editableElement;
+    }
+
+    return targetNode->renderer()->positionForPoint(selectionEndPoint);
 }