diff options
author | John Reck <jreck@google.com> | 2012-02-27 15:40:02 -0800 |
---|---|---|
committer | John Reck <jreck@google.com> | 2012-02-27 17:56:36 -0800 |
commit | 9b759976fec55ad944eba534a560c9c83400ed91 (patch) | |
tree | c5f886458f9866b82a0780ca52a799a288d0cd5a /Source/WebCore | |
parent | 55fce40b4f3cdc9f93daba59d8ff9c311de4b9c0 (diff) | |
download | external_webkit-9b759976fec55ad944eba534a560c9c83400ed91.zip external_webkit-9b759976fec55ad944eba534a560c9c83400ed91.tar.gz external_webkit-9b759976fec55ad944eba534a560c9c83400ed91.tar.bz2 |
Fix content detector crashes
Bug: 6075831
Add some sanity checks to AndroidHitTestResult
Update DOMTextContentWalker to latest which had some extra checks
Change-Id: If6d129e78712c8cfc5ec84e48487e32cc585680f
Diffstat (limited to 'Source/WebCore')
-rw-r--r-- | Source/WebCore/dom/DOMTextContentWalker.cpp | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/Source/WebCore/dom/DOMTextContentWalker.cpp b/Source/WebCore/dom/DOMTextContentWalker.cpp index ccbe1ec..5e77db1 100644 --- a/Source/WebCore/dom/DOMTextContentWalker.cpp +++ b/Source/WebCore/dom/DOMTextContentWalker.cpp @@ -44,15 +44,20 @@ DOMTextContentWalker::DOMTextContentWalker(const VisiblePosition& position, unsi : m_hitOffsetInContent(0) { const unsigned halfMaxLength = maxLength / 2; - CharacterIterator forwardChar(makeRange(position, endOfDocument(position)).get(), TextIteratorStopsOnFormControls); + RefPtr<Range> forwardRange = makeRange(position, endOfDocument(position)); + if (!forwardRange) + return; + CharacterIterator forwardChar(forwardRange.get(), TextIteratorStopsOnFormControls); forwardChar.advance(maxLength - halfMaxLength); // No forward contents, started inside form control. - RefPtr<Range> range = getRange(position.deepEquivalent(), forwardChar.range()->startPosition()); - if (!range.get() || range->text().length() == 0) + if (getRange(position.deepEquivalent(), forwardChar.range()->startPosition())->text().length() == 0) return; - BackwardsCharacterIterator backwardsChar(makeRange(startOfDocument(position), position).get(), TextIteratorStopsOnFormControls); + RefPtr<Range> backwardsRange = makeRange(startOfDocument(position), position); + if (!backwardsRange) + return; + BackwardsCharacterIterator backwardsChar(backwardsRange.get(), TextIteratorStopsOnFormControls); backwardsChar.advance(halfMaxLength); m_hitOffsetInContent = getRange(backwardsChar.range()->endPosition(), position.deepEquivalent())->text().length(); |