Chromium Code Reviews Chromium Code Reviews
Issue
26168008:
[blink] Avoid null pointer dereference in HitTestResult::isMisspelled() (Closed)
Description[blink] Avoid null pointer dereference in HitTestResult::isMisspelled()
The method HitTestResult::isMisspelled() assumed that renderer would
always be present in the right-clicked editable item. This is not the case
when right-clicking on an item in an editable combobox created by jQuery
Searchable DropDown Plugin (http://jsearchdropdown.sf.net).
This patch changes HitTestResult::isMisspelled() to check if the renderer
is present. If there's no renderer, then the method returns false (there
shouldn't be spellcheck related items in the context menu).
Manual test 1: Click on the drop-down on http://jsearchdropdown.sf.net and
right-click on any of the items. The page should not crash.
Manual test 2: Run the following script and right-click anywhere on the
page. The page should not crash.
<html>
<head>
<script>
window.onload = function() {
var element = document.getElementsByTagName('html')[0];
document.adoptNode(element);
var newElement = document.createElementNS('http://www.w3.org/2000/svg', 'title');
document.appendChild(newElement);
document.execCommand('SelectAll', false)
document.designMode = 'on';
};
</script>
</head>
</html>
TEST=LayoutTests/editing/spelling/right-click-no-renderer-crash.html
BUG=304165
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=168490
Patch Set 1 #Patch Set 2 : Add a layout test #Patch Set 3 : Add expectations. #
Total comments: 6
Patch Set 4 : Select HTML element, click on position 10x10. #Patch Set 5 : Move is-misspelled logic to event handler. #Patch Set 6 : Original fix #
Messages
Total messages: 34 (0 generated)
|
|||||||||||||||||||||||||||||||||||||
