Bug 139506 – Null dereference performing a "TapAndAHalf" gesture in Google search field

• Component: WebKit2
• Status: RESOLVED FIXED

[Jon Honeycutt]

A null dereference can occur when performing a "TapAndAHalf" gesture in the Google search field.

Repro test case:

data:text/html,<input%20size="40"%20%20placeholder="Perform%20a%20tap%20and%20a%20half%20gesture%20in%20this%20field">

<rdar://problem/19028828>

[Jon Honeycutt]

Created attachment 243066 [details]
Patch

[Darin Adler]

Comment on attachment 243066 [details]
Patch

This change seems OK, but just a few lines later I see code that calls Range::create and dereferences the result unconditionally. I think we should consistently handle null in both places in this function instead of just in this one place.

[Jon Honeycutt]

(In reply to comment #2)
> Comment on attachment 243066 [details]
> Patch
> 
> This change seems OK, but just a few lines later I see code that calls
> Range::create and dereferences the result unconditionally. I think we should
> consistently handle null in both places in this function instead of just in
> this one place.

This adds a null check for the result of wordRangeFromPosition before calling Range::create. Range::create doesn't return null.

Thanks for the review!

[Jon Honeycutt]

Committed r177115: <http://trac.webkit.org/changeset/177115>