Bug 171925 - REGRESSION (r206960): Possible null pointer dereference under DOMSelection::getRangeAt()
Summary: REGRESSION (r206960): Possible null pointer dereference under DOMSelection::g...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: HTML Editing (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Chris Dumez
URL:
Keywords: InRadar
Depends on:
Blocks: 163016
  Show dependency treegraph
 
Reported: 2017-05-10 09:06 PDT by Chris Dumez
Modified: 2017-05-10 12:52 PDT (History)
4 users (show)

See Also:


Attachments
Patch (1.92 KB, patch)
2017-05-10 09:10 PDT, Chris Dumez
wenson_hsieh: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Chris Dumez 2017-05-10 09:06:23 PDT
Possible null pointer dereference under DOMSelection::getRangeAt() after r206960.
Comment 1 Chris Dumez 2017-05-10 09:06:45 PDT
<rdar://problem/29931223>
Comment 2 Chris Dumez 2017-05-10 09:10:18 PDT
Created attachment 309613 [details]
Patch
Comment 3 Chris Dumez 2017-05-10 10:02:25 PDT
Comment on attachment 309613 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=309613&action=review

> Source/WebCore/ChangeLog:14
> +        if isNoneOrOrphaned().

Note that another proposal would be to update DOMSelection::rangeCount() to check isNoneOrOrphaned() instead of isNone() because there is currently a mismatch between rangeCount() (which checks isNone()) and firstRange() which returns null if isNoneOrOrphaned(). However, this seemed like a largest impact change and I am not familiar enough with this code to guarantee this is safe.
Comment 4 Ryosuke Niwa 2017-05-10 12:11:47 PDT
Comment on attachment 309613 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=309613&action=review

> Source/WebCore/page/DOMSelection.cpp:309
> +    if (!firstRange)
> +        return Exception { INDEX_SIZE_ERR };

Could you add an assertion that firstRange is not null. Because if this is happening, then there's a bug elsewhere in the editing bug.
Comment 5 Chris Dumez 2017-05-10 12:52:26 PDT
Committed r216607: <http://trac.webkit.org/changeset/216607>