Bug 22160 – Nil deref because nextLinePosition (previousLinePosition, too) uses a nil node

• Status: RESOLVED
• Resolution: FIXED
• Component: HTML Editing

[Darin Adler]

Chris Fleizach noticed this crash while in a mail message. looks like a node needs to be checked for nil somewhere

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x0000000000000000
0x000000010113bf1a in WebCore::Node::hasTagName (this=0x0, name=@0x10224b698) at Node.h:95
95	    bool hasTagName(const QualifiedName& name) const { return virtualHasTagName(name); }
(gdb) bt
#0  0x000000010113bf1a in WebCore::Node::hasTagName (this=0x0, name=@0x10224b698) at Node.h:95
#1  0x00000001017d87ec in WebCore::canHaveChildrenForEditing (node=0x0) at /Volumes/data/WebKit/WebCore/editing/htmlediting.cpp:78
#2  0x00000001017d895b in WebCore::editingIgnoresContent (node=0x0) at /Volumes/data/WebKit/WebCore/editing/htmlediting.cpp:62
#3  0x00000001017fcfa0 in WebCore::nextLinePosition (visiblePosition=@0x7fff5fbfe4a0, x=95) at /Volumes/data/WebKit/WebCore/editing/visible_units.cpp:605
#4  0x0000000101755d62 in WebCore::SelectionController::modifyMovingForward (this=0x7fff5fbfe580, granularity=WebCore::LineGranularity) at /Volumes/data/WebKit/WebCore/editing/SelectionController.cpp:335

etc.

[Darin Adler]

Created attachment 25022 [details]
patch

Comment on attachment 25022 [details]
patch

r=me

[Darin Adler]

http://trac.webkit.org/changeset/38304

[David Kilzer (:ddkilzer)]

See also Bug 20482.

[David Kilzer (:ddkilzer)]

<rdar://problem/5995450>