Bug 130271

Summary:

REGRESSION(r165385): [WebTextIterator currentRange] crashes

Product:

WebKit

Reporter:

Ryosuke Niwa <rniwa>

Component:

HTML Editing

Assignee:

Ryosuke Niwa <rniwa>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

andersca, commit-queue, darin, enrica

Priority:

Version:

528+ (Nightly build)

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
Fixes the crash	none
Reverted the erroneous jsc change.	none

Description Ryosuke Niwa 2014-03-14 16:38:24 PDT

After http://trac.webkit.org/changeset/165385, TextIterator::range no longer checked the nullity of m_positionNode.
As a result, [WebTextIterator currentRange] which simply calls TextIterator::range crashes.

Since applications that embed WebKit don't necessarily check atEnd before calling [WebTextIterator currentRange]
we need to keep the null check there.

Comment 1 Ryosuke Niwa 2014-03-14 16:41:55 PDT

Created attachment 226776 [details]
Fixes the crash

Comment 2 Ryosuke Niwa 2014-03-14 16:42:38 PDT

Created attachment 226777 [details]
Reverted the erroneous jsc change.

Comment 3 WebKit Commit Bot 2014-03-14 16:55:59 PDT

Comment on attachment 226777 [details]
Reverted the erroneous jsc change.

Clearing flags on attachment: 226777

Committed r165664: <http://trac.webkit.org/changeset/165664>

Comment 4 WebKit Commit Bot 2014-03-14 16:56:02 PDT

All reviewed patches have been landed.  Closing bug.

Comment 5 Darin Adler 2014-03-15 14:27:17 PDT

Comment on attachment 226777 [details]
Reverted the erroneous jsc change.

View in context: https://bugs.webkit.org/attachment.cgi?id=226777&action=review

> Source/WebKit/mac/ChangeLog:12
> +        Preserve the old public API behavior by checking atEnd in [WebTextIterator currentRange].

Was the old public API behavior returning nil? I think that it might have returned a range, rather than nil, before. So this might not be a sufficient fix.

What about the other methods of WebTextIterator?

Comment 6 Ryosuke Niwa 2014-03-16 19:27:51 PDT

Comment on attachment 226777 [details]
Reverted the erroneous jsc change.

View in context: https://bugs.webkit.org/attachment.cgi?id=226777&action=review

>> Source/WebKit/mac/ChangeLog:12
>> +        Preserve the old public API behavior by checking atEnd in [WebTextIterator currentRange].
> 
> Was the old public API behavior returning nil? I think that it might have returned a range, rather than nil, before. So this might not be a sufficient fix.
> 
> What about the other methods of WebTextIterator?

The old TextIterator::range returned 0 when m_positionNode was null:
http://trac.webkit.org/browser/trunk/Source/WebCore/editing/TextIterator.cpp?rev=165384#L1101

I don't think other methods have the same issue.