Title: [273367] trunk/Source/WebKit
- Revision
- 273367
- Author
- [email protected]
- Date
- 2021-02-23 18:18:39 -0800 (Tue, 23 Feb 2021)
Log Message
[iOS] Add null checks for Node before accessing treeScope() in rangeForPointInRootViewCoordinates
https://bugs.webkit.org/show_bug.cgi?id=222338
<rdar://problem/72292289>
Reviewed by Tim Horton.
Add a null check for the hit test result's `targetNode` inside `rangeForPointInRootViewCoordinates()` to avoid
crashing in the case where the target node is null and either `result <= selectionStart` is `false` or
`selectionEnd <= result` is `false`.
Additionally, avoid a potential null deref on `selectionStart.deepEquivalent().anchorNode()` and
`selectionEnd.deepEquivalent().anchorNode()` by using `Position::treeScope()` (which null checks the anchor
node) instead of directly asking the anchor node.
Note that the call sites of `rangeForPointInRootViewCoordinates()` already handle a `WTF::nullopt` return value
gracefully, by skipping the selection update.
* WebProcess/WebPage/ios/WebPageIOS.mm:
(WebKit::rangeForPointInRootViewCoordinates):
Modified Paths
Diff
Modified: trunk/Source/WebKit/ChangeLog (273366 => 273367)
--- trunk/Source/WebKit/ChangeLog 2021-02-24 01:41:31 UTC (rev 273366)
+++ trunk/Source/WebKit/ChangeLog 2021-02-24 02:18:39 UTC (rev 273367)
@@ -1,3 +1,25 @@
+2021-02-23 Wenson Hsieh <[email protected]>
+
+ [iOS] Add null checks for Node before accessing treeScope() in rangeForPointInRootViewCoordinates
+ https://bugs.webkit.org/show_bug.cgi?id=222338
+ <rdar://problem/72292289>
+
+ Reviewed by Tim Horton.
+
+ Add a null check for the hit test result's `targetNode` inside `rangeForPointInRootViewCoordinates()` to avoid
+ crashing in the case where the target node is null and either `result <= selectionStart` is `false` or
+ `selectionEnd <= result` is `false`.
+
+ Additionally, avoid a potential null deref on `selectionStart.deepEquivalent().anchorNode()` and
+ `selectionEnd.deepEquivalent().anchorNode()` by using `Position::treeScope()` (which null checks the anchor
+ node) instead of directly asking the anchor node.
+
+ Note that the call sites of `rangeForPointInRootViewCoordinates()` already handle a `WTF::nullopt` return value
+ gracefully, by skipping the selection update.
+
+ * WebProcess/WebPage/ios/WebPageIOS.mm:
+ (WebKit::rangeForPointInRootViewCoordinates):
+
2021-02-23 Patrick Angle <[email protected]>
[Cocoa] Web Inspector: Add support for reloading the inspected page via _WKInspectorExtension
Modified: trunk/Source/WebKit/WebProcess/WebPage/ios/WebPageIOS.mm (273366 => 273367)
--- trunk/Source/WebKit/WebProcess/WebPage/ios/WebPageIOS.mm 2021-02-24 01:41:31 UTC (rev 273366)
+++ trunk/Source/WebKit/WebProcess/WebPage/ios/WebPageIOS.mm 2021-02-24 02:18:39 UTC (rev 273367)
@@ -1518,9 +1518,10 @@
Optional<SimpleRange> range;
constexpr OptionSet<HitTestRequest::RequestType> hitType { HitTestRequest::ReadOnly, HitTestRequest::Active, HitTestRequest::AllowVisibleChildFrameContentOnly };
- HitTestResult hitTest = frame.eventHandler().hitTestResultAtPoint(pointInDocument, hitType);
- if (hitTest.targetNode())
- result = frame.eventHandler().selectionExtentRespectingEditingBoundary(frame.selection().selection(), hitTest.localPoint(), hitTest.targetNode()).deepEquivalent();
+ auto hitTest = frame.eventHandler().hitTestResultAtPoint(pointInDocument, hitType);
+ auto targetNode = makeRefPtr(hitTest.targetNode());
+ if (targetNode)
+ result = frame.eventHandler().selectionExtentRespectingEditingBoundary(frame.selection().selection(), hitTest.localPoint(), targetNode.get()).deepEquivalent();
else
result = frame.visiblePositionForPoint(pointInDocument).deepEquivalent();
@@ -1527,7 +1528,7 @@
if (baseIsStart) {
if (result <= selectionStart)
result = selectionStart.next();
- else if (&selectionStart.deepEquivalent().anchorNode()->treeScope() != &hitTest.targetNode()->treeScope())
+ else if (targetNode && selectionStart.deepEquivalent().treeScope() != &targetNode->treeScope())
result = VisibleSelection::adjustPositionForEnd(result.deepEquivalent(), selectionStart.deepEquivalent().containerNode());
range = makeSimpleRange(selectionStart, result);
@@ -1534,7 +1535,7 @@
} else {
if (selectionEnd <= result)
result = selectionEnd.previous();
- else if (&hitTest.targetNode()->treeScope() != &selectionEnd.deepEquivalent().anchorNode()->treeScope())
+ else if (targetNode && selectionEnd.deepEquivalent().treeScope() != &targetNode->treeScope())
result = VisibleSelection::adjustPositionForStart(result.deepEquivalent(), selectionEnd.deepEquivalent().containerNode());
range = makeSimpleRange(result, selectionEnd);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
