171925 2017-05-10 09:06:23 -0700 REGRESSION (r206960): Possible null pointer dereference under DOMSelection::getRangeAt() 2017-05-10 12:52:26 -0700 1 1 1 Unclassified WebKit HTML Editing WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 163016 1 cdumez cdumez darin rniwa webkit-bug-importer wenson_hsieh oldest_to_newest 1306866 0 cdumez 2017-05-10 09:06:23 -0700 Possible null pointer dereference under DOMSelection::getRangeAt() after r206960. 1306869 1 cdumez 2017-05-10 09:06:45 -0700 <rdar://problem/29931223> 1306872 2 309613 cdumez 2017-05-10 09:10:18 -0700 Created attachment 309613 Patch 1306902 3 309613 cdumez 2017-05-10 10:02:25 -0700 Comment on attachment 309613 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=309613&action=review > Source/WebCore/ChangeLog:14 > + if isNoneOrOrphaned(). Note that another proposal would be to update DOMSelection::rangeCount() to check isNoneOrOrphaned() instead of isNone() because there is currently a mismatch between rangeCount() (which checks isNone()) and firstRange() which returns null if isNoneOrOrphaned(). However, this seemed like a largest impact change and I am not familiar enough with this code to guarantee this is safe. 1306943 4 309613 rniwa 2017-05-10 12:11:47 -0700 Comment on attachment 309613 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=309613&action=review > Source/WebCore/page/DOMSelection.cpp:309 > + if (!firstRange) > + return Exception { INDEX_SIZE_ERR }; Could you add an assertion that firstRange is not null. Because if this is happening, then there's a bug elsewhere in the editing bug. 1306954 5 cdumez 2017-05-10 12:52:26 -0700 Committed r216607: <http://trac.webkit.org/changeset/216607> 309613 2017-05-10 09:10:18 -0700 2017-05-10 09:52:44 -0700 Patch bug-171925-20170510091016.patch text/plain 1964 cdumez U3VidmVyc2lvbiBSZXZpc2lvbjogMjE2NTg1CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggNmRkYzU4NDdmMDViOTMy N2EzNzRjZjgzZTZjMWE4ODM3ODRiNDg4Ni4uOGFkNTYyNDdmNzk5OTgzM2YzMjg2YTVhNjgwNTFm OTVlMTVlYmY2NCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIzIEBACisyMDE3LTA1LTEwICBDaHJp cyBEdW1leiAgPGNkdW1lekBhcHBsZS5jb20+CisKKyAgICAgICAgUkVHUkVTU0lPTiAocjIwNjk2 MCk6IFBvc3NpYmxlIG51bGwgcG9pbnRlciBkZXJlZmVyZW5jZSB1bmRlciBET01TZWxlY3Rpb246 OmdldFJhbmdlQXQoKQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5j Z2k/aWQ9MTcxOTI1CisgICAgICAgIDxyZGFyOi8vcHJvYmxlbS8yOTkzMTIyMz4KKworICAgICAg ICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBXZSBoYXZlIGV2aWRlbmNl IHRoYXQgc2VsZWN0aW9uKCkuZmlyc3RSYW5nZSgpIGNhbiByZXR1cm4gbnVsbCBpbiBET01TZWxl Y3Rpb246OmdldFJhbmdlQXQoKS4KKyAgICAgICAgV2hlbiB0aGlzIGhhcHBlbnMsIHdlIG5vdyB0 aHJvdyBhbiBJTkRFWF9TSVpFX0VSUiBpbnN0ZWFkIG9mIGRlcmVmZXJlbmNpbmcgaXQuCisKKyAg ICAgICAgSSBiZWxpZXZlIHRoaXMgY2FuIGhhcHBlbiBpZiB0aGUgVmlzaWJsZVNlbGVjdGlvbiBp cyBvcnBoYW5lZCBidXQgbm90IG5vbmUsIGJlY2F1c2UKKyAgICAgICAgcmFuZ2VDb3VudCgpIG9u bHkgY2hlY2tzIGZvciBpc05vbmUoKSBidXQgVmlzaWJsZVNlbGVjdGlvbjo6Zmlyc3RSYW5nZSgp IGNhbiByZXR1cm4gbnVsbAorICAgICAgICBpZiBpc05vbmVPck9ycGhhbmVkKCkuCisKKyAgICAg ICAgTm8gbmV3IHRlc3RzLCBJIGRvIG5vdCBrbm93IGhvdyB0byByZXByb2R1Y2UuCisKKyAgICAg ICAgKiBwYWdlL0RPTVNlbGVjdGlvbi5jcHA6CisgICAgICAgIChXZWJDb3JlOjpET01TZWxlY3Rp b246OmdldFJhbmdlQXQpOgorCiAyMDE3LTA1LTEwICBNaWNoYWVsIENhdGFuemFybyAgPG1jYXRh bnphcm9AaWdhbGlhLmNvbT4KIAogICAgICAgICBSZW1vdmUgdXNlciBhZ2VudCBxdWlyayBmb3Ig U2xhY2sKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL3BhZ2UvRE9NU2VsZWN0aW9uLmNwcCBi L1NvdXJjZS9XZWJDb3JlL3BhZ2UvRE9NU2VsZWN0aW9uLmNwcAppbmRleCBmNmY0ZWRjYTJkNzBj OTZkYWNjYzAwODFkYTI2ZDMwY2U5ODc5MTI2Li5jMzg0MGE4ZGViYmJlOTE4NGM3ZGM4ZGQ4YTcz ZDJiMDhmZThmYTA1IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9wYWdlL0RPTVNlbGVjdGlv bi5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvcGFnZS9ET01TZWxlY3Rpb24uY3BwCkBAIC0zMDQs NyArMzA0LDEwIEBAIEV4Y2VwdGlvbk9yPFJlZjxSYW5nZT4+IERPTVNlbGVjdGlvbjo6Z2V0UmFu Z2VBdCh1bnNpZ25lZCBpbmRleCkKICAgICAgICAgcmV0dXJuIFJhbmdlOjpjcmVhdGUoc2hhZG93 QW5jZXN0b3ItPmRvY3VtZW50KCksIGNvbnRhaW5lciwgb2Zmc2V0LCBjb250YWluZXIsIG9mZnNl dCk7CiAgICAgfQogCi0gICAgcmV0dXJuIG1fZnJhbWUtPnNlbGVjdGlvbigpLnNlbGVjdGlvbigp LmZpcnN0UmFuZ2UoKS5yZWxlYXNlTm9uTnVsbCgpOworICAgIGF1dG8gZmlyc3RSYW5nZSA9IG1f ZnJhbWUtPnNlbGVjdGlvbigpLnNlbGVjdGlvbigpLmZpcnN0UmFuZ2UoKTsKKyAgICBpZiAoIWZp cnN0UmFuZ2UpCisgICAgICAgIHJldHVybiBFeGNlcHRpb24geyBJTkRFWF9TSVpFX0VSUiB9Owor ICAgIHJldHVybiBmaXJzdFJhbmdlLnJlbGVhc2VOb25OdWxsKCk7CiB9CiAKIHZvaWQgRE9NU2Vs ZWN0aW9uOjpyZW1vdmVBbGxSYW5nZXMoKQo=