Possible null pointer dereference under DOMSelection::getRangeAt() after r206960.
<rdar://problem/29931223>
Created attachment 309613 [details] Patch
Comment on attachment 309613 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=309613&action=review > Source/WebCore/ChangeLog:14 > + if isNoneOrOrphaned(). Note that another proposal would be to update DOMSelection::rangeCount() to check isNoneOrOrphaned() instead of isNone() because there is currently a mismatch between rangeCount() (which checks isNone()) and firstRange() which returns null if isNoneOrOrphaned(). However, this seemed like a largest impact change and I am not familiar enough with this code to guarantee this is safe.
Comment on attachment 309613 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=309613&action=review > Source/WebCore/page/DOMSelection.cpp:309 > + if (!firstRange) > + return Exception { INDEX_SIZE_ERR }; Could you add an assertion that firstRange is not null. Because if this is happening, then there's a bug elsewhere in the editing bug.
Committed r216607: <http://trac.webkit.org/changeset/216607>