Title: [179632] branches/safari-600.5-branch/Source/WebKit2
- Revision
- 179632
- Author
- [email protected]
- Date
- 2015-02-04 14:05:00 -0800 (Wed, 04 Feb 2015)
Log Message
Merge r179066. rdar://problem/19670515
Modified Paths
Diff
Modified: branches/safari-600.5-branch/Source/WebKit2/ChangeLog (179631 => 179632)
--- branches/safari-600.5-branch/Source/WebKit2/ChangeLog 2015-02-04 22:04:57 UTC (rev 179631)
+++ branches/safari-600.5-branch/Source/WebKit2/ChangeLog 2015-02-04 22:05:00 UTC (rev 179632)
@@ -1,3 +1,16 @@
+2015-02-02 Matthew Hanson <[email protected]>
+
+ Merge r179066. rdar://problem/19670515
+
+ 2015-01-24 David Kilzer <[email protected]>
+
+ <rdar://problem/19433134> REGRESSION (iOS 8): Reproducible null deref in WebKit::nextFocusableElement
+
+ Merged small change from r175549.
+
+ * WebProcess/WebPage/ios/WebPageIOS.mm:
+ (WebKit::nextFocusableElement): Add isElementNode() check.
+
2015-01-20 Babak Shafiei <[email protected]>
Merge r173737.
Modified: branches/safari-600.5-branch/Source/WebKit2/WebProcess/WebPage/ios/WebPageIOS.mm (179631 => 179632)
--- branches/safari-600.5-branch/Source/WebKit2/WebProcess/WebPage/ios/WebPageIOS.mm 2015-02-04 22:04:57 UTC (rev 179631)
+++ branches/safari-600.5-branch/Source/WebKit2/WebProcess/WebPage/ios/WebPageIOS.mm 2015-02-04 22:05:00 UTC (rev 179632)
@@ -1993,6 +1993,9 @@
static inline Element* nextFocusableElement(Node* startNode, Page* page, bool isForward)
{
+ if (!startNode->isElementNode())
+ return nullptr;
+
RefPtr<KeyboardEvent> key = KeyboardEvent::create();
Element* nextElement = toElement(startNode);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
