Changeset 88685 in webkit

Timestamp:

Jun 13, 2011 1:46:24 PM (13 years ago)

Author:

rniwa@webkit.org

Message:

2011-06-13 Ryosuke Niwa <​rniwa@webkit.org>

Reviewed by Dan Bernstein.

REGRESSION (r81518): Crash in makeRange() when invoking the dictionary panel over a file input
​https://bugs.webkit.org/show_bug.cgi?id=62544

Fixed the crash by adding null pointer checks.

No new tests since there's no way to open dictionary panel.

• dom/Position.cpp: (WebCore::Position::parentAnchoredEquivalent):
• editing/VisiblePosition.cpp: (WebCore::makeRange):
• page/Frame.cpp: (WebCore::Frame::rangeForPoint):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• dom/Position.cpp (modified) (1 diff)
• editing/VisiblePosition.cpp (modified) (1 diff)
• page/Frame.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-06-13  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION (r81518): Crash in makeRange() when invoking the dictionary panel over a file input
+        https://bugs.webkit.org/show_bug.cgi?id=62544
+
+        Fixed the crash by adding null pointer checks.
+
+        No new tests since there's no way to open dictionary panel.
+
+        * dom/Position.cpp:
+        (WebCore::Position::parentAnchoredEquivalent):
+        * editing/VisiblePosition.cpp:
+        (WebCore::makeRange):
+        * page/Frame.cpp:
+        (WebCore::Frame::rangeForPoint):
+
 2011-06-13  Adam Barth  <abarth@webkit.org>
 

trunk/Source/WebCore/dom/Position.cpp

@@ -175 +175 @@
     }
     if (!m_anchorNode->offsetInCharacters() && (m_anchorType == PositionIsAfterAnchor || static_cast<unsigned>(m_offset) == m_anchorNode->childNodeCount())
-        && (editingIgnoresContent(m_anchorNode.get()) || isTableElement(m_anchorNode.get()))) {
+        && (editingIgnoresContent(m_anchorNode.get()) || isTableElement(m_anchorNode.get()))
+        && containerNode()) {
         return positionInParentAfterNode(m_anchorNode.get());
     }

trunk/Source/WebCore/editing/VisiblePosition.cpp

@@ -633 +633 @@
     Position s = start.deepEquivalent().parentAnchoredEquivalent();
     Position e = end.deepEquivalent().parentAnchoredEquivalent();
+    if (s.isNull() || e.isNull())
+        return 0;
+
     return Range::create(s.containerNode()->document(), s.containerNode(), s.offsetInContainerNode(), e.containerNode(), e.offsetInContainerNode());
 }

trunk/Source/WebCore/page/Frame.cpp

@@ -899 +899 @@
 
     VisiblePosition next = position.next();
-    if (next.isNotNull()) {
-        RefPtr<Range> nextCharacterRange = makeRange(position, next);
+    if (RefPtr<Range> nextCharacterRange = makeRange(position, next)) {
         IntRect rect = editor()->firstRectForRange(nextCharacterRange.get());
         if (rect.contains(framePoint))