A null dereference can occur when performing a "TapAndAHalf" gesture in the Google search field. Repro test case: data:text/html,<input%20size="40"%20%20placeholder="Perform%20a%20tap%20and%20a%20half%20gesture%20in%20this%20field"> <rdar://problem/19028828>
Created attachment 243066 [details] Patch
Comment on attachment 243066 [details] Patch This change seems OK, but just a few lines later I see code that calls Range::create and dereferences the result unconditionally. I think we should consistently handle null in both places in this function instead of just in this one place.
(In reply to comment #2) > Comment on attachment 243066 [details] > Patch > > This change seems OK, but just a few lines later I see code that calls > Range::create and dereferences the result unconditionally. I think we should > consistently handle null in both places in this function instead of just in > this one place. This adds a null check for the result of wordRangeFromPosition before calling Range::create. Range::create doesn't return null. Thanks for the review!
Committed r177115: <http://trac.webkit.org/changeset/177115>