Bug 1267929 - Bail out from ExtendPhoneNumberSelection if GetAnchorFocusRange() is nullptr.
MozReview-Commit-ID: HvNhZ5o0owh
--- a/layout/base/AccessibleCaretManager.cpp
+++ b/layout/base/AccessibleCaretManager.cpp
@@ -862,20 +862,24 @@ void
AccessibleCaretManager::ExtendPhoneNumberSelection(const nsAString& aDirection) const
{
nsIDocument* doc = mPresShell->GetDocument();
// Extend the phone number selection until we find a boundary.
Selection* selection = GetSelection();
while (selection) {
+ const nsRange* anchorFocusRange = selection->GetAnchorFocusRange();
+ if (!anchorFocusRange) {
+ return;
+ }
+
// Backup the anchor focus range since both anchor node and focus node might
// be changed after calling Selection::Modify().
- RefPtr<nsRange> oldAnchorFocusRange =
- selection->GetAnchorFocusRange()->CloneRange();
+ RefPtr<nsRange> oldAnchorFocusRange = anchorFocusRange->CloneRange();
// Save current Focus position, and extend the selection one char.
nsINode* focusNode = selection->GetFocusNode();
uint32_t focusOffset = selection->FocusOffset();
selection->Modify(NS_LITERAL_STRING("extend"),
aDirection,
NS_LITERAL_STRING("character"));