Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: b444717fbb43dfc8a567db476ace60e8ff3efe02
https://github.com/WebKit/WebKit/commit/b444717fbb43dfc8a567db476ace60e8ff3efe02
Author: Ruthvik Konda <[email protected]>
Date: 2026-05-07 (Thu, 07 May 2026)
Changed paths:
A
LayoutTests/editing/mac/spelling/respond-to-changed-selection-null-end-of-word-crash-expected.txt
A
LayoutTests/editing/mac/spelling/respond-to-changed-selection-null-end-of-word-crash.html
M Source/WebCore/editing/AlternativeTextController.cpp
Log Message:
-----------
REGRESSION(310941@main): Null deref in
AlternativeTextController::respondToChangedSelection when endOfWord() returns
null
https://bugs.webkit.org/show_bug.cgi?id=314157
rdar://176140938
Reviewed by Megan Gardner and Ryosuke Niwa.
310941@main removed the `if (selectionPosition != endPositionOfWord) return;`
guard, which had incidentally guaranteed that `endPositionOfWord` was non-null
(since `selectionPosition` is null-checked just above). `endOfWord()` can
legitimately return a null VisiblePosition when canonicalPosition refuses to
produce a position that crosses an editable-root boundary -- for example, when
a fullscreen element creates an editable island whose parent is inert. A
default-constructed Position has anchorType() == PositionIsOffsetInAnchor, so
the existing anchorType() check does not reject the null case, and we crash
dereferencing the null result of `position.containerNode()`.
Add an explicit null check on `endPositionOfWord`, matching the established
pattern in Editor::updateMarkersForWordsAffectedByEditing. Also move the
`ASSERT(node)` to immediately after `containerNode()` -- it previously sat
after `node->document()`, where it was unreachable.
*
LayoutTests/editing/mac/spelling/respond-to-changed-selection-null-end-of-word-crash-expected.txt:
Added.
*
LayoutTests/editing/mac/spelling/respond-to-changed-selection-null-end-of-word-crash.html:
Added.
* Source/WebCore/editing/AlternativeTextController.cpp:
(WebCore::AlternativeTextController::respondToChangedSelection):
Canonical link: https://commits.webkit.org/312857@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
