Bug 160823 – Dereferenced NULL pointer in StyleResolver

• Component: CSS
• Status: RESOLVED FIXED

[Jonathan Bedard]

In StyleResolver::CascadedProperties::addMatch(...) a point which is sometimes NULL is dereferenced before being provided as an argument to StyleResolver::CascadedProperties::addStyleProperties(...).

[Jonathan Bedard]

Created attachment 285955 [details]
Patch

[Sam Weinig]

I don't understand how fixing a nullptr dereference can be no change in behavior? Dereferencing a nullptr will crash the program, so removing it would fix the crash and therefore be testable.  Is that not the case here somehow?

[Darin Adler]

(In reply to comment #2)
> I don't understand how fixing a nullptr dereference can be no change in
> behavior? Dereferencing a nullptr will crash the program, so removing it
> would fix the crash and therefore be testable.  Is that not the case here
> somehow?

Dereferencing a null pointer and then passing the resulting reference does not necessarily crash the program; as you know under the hood references are implemented almost the same way that pointers are.

But Jonathan is using some kind of "undefined behavior testing mode" for clang, and so he was able to detect that the value is null. The rest of us are using clang in its normal compilation mode and like all the other compilers it just passes null to the function, which ignores the passed-in reference.

[WebKit Commit Bot]

Comment on attachment 285955 [details]
Patch

Clearing flags on attachment: 285955

Committed r204455: <http://trac.webkit.org/changeset/204455>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.