Bug 193996 – iOS: Nullptr crash in WebPage::getPositionInformation dereferencing an input element for data list

• Component: WebKit2
• Status: RESOLVED FIXED

[Ryosuke Niwa]

We're crashing in the middle in the following code because hitNode can be nullptr here.

#if ENABLE(DATALIST_ELEMENT)
    if (is<HTMLInputElement>(*hitNode)) {
        const HTMLInputElement& input = downcast<HTMLInputElement>(*hitNode);
        if (input.list()) {
            HitTestResult result = m_page->mainFrame().eventHandler().hitTestResultAtPoint(request.point, HitTestRequest::ReadOnly | HitTestRequest::Active);
            if (result.innerNode() == input.dataListButtonElement())
                info.preventTextInteraction = true;
        }
    }
#endif

<rdar://problem/31247273>

[Ryosuke Niwa]

Created attachment 360524 [details]
Fixes the bug

[Wenson Hsieh]

Comment on attachment 360524 [details]
Fixes the bug

View in context: https://bugs.webkit.org/attachment.cgi?id=360524&action=review

> Source/WebKit/WebProcess/WebPage/ios/WebPageIOS.mm:2251
> +    if (hitNode && is<HTMLInputElement>(*hitNode)) {

Let's just check is<HTMLInputElement>(hitNode).

[Ryosuke Niwa]

Created attachment 360525 [details]
Patch for landing

[Ryosuke Niwa]

Comment on attachment 360525 [details]
Patch for landing

Wait for EWS.

[Ryosuke Niwa]

Committed r240702: <https://trac.webkit.org/changeset/240702>