Bug 1267929 - Bail out from ExtendPhoneNumberSelection if GetAnchorFocusRange() is nullptr. draft
authorTing-Yu Lin <tlin@mozilla.com>
Wed, 27 Apr 2016 17:19:51 +0800
changeset 356857 0e6730485fe5a4562d4038152d13e8c59e46e2e6
parent 356700 52072b6bec1416578615ec73027eb80a65d3fcd4
child 356858 e766eedc3239dbabb8444ef1b5d940bbc93134b3
push id16621
push usertlin@mozilla.com
push dateWed, 27 Apr 2016 09:20:24 +0000
bugs1267929
milestone49.0a1
Bug 1267929 - Bail out from ExtendPhoneNumberSelection if GetAnchorFocusRange() is nullptr. MozReview-Commit-ID: HvNhZ5o0owh
layout/base/AccessibleCaretManager.cpp
--- a/layout/base/AccessibleCaretManager.cpp
+++ b/layout/base/AccessibleCaretManager.cpp
@@ -862,20 +862,24 @@ void
 AccessibleCaretManager::ExtendPhoneNumberSelection(const nsAString& aDirection) const
 {
   nsIDocument* doc = mPresShell->GetDocument();
 
   // Extend the phone number selection until we find a boundary.
   Selection* selection = GetSelection();
 
   while (selection) {
+    const nsRange* anchorFocusRange = selection->GetAnchorFocusRange();
+    if (!anchorFocusRange) {
+      return;
+    }
+
     // Backup the anchor focus range since both anchor node and focus node might
     // be changed after calling Selection::Modify().
-    RefPtr<nsRange> oldAnchorFocusRange =
-      selection->GetAnchorFocusRange()->CloneRange();
+    RefPtr<nsRange> oldAnchorFocusRange = anchorFocusRange->CloneRange();
 
     // Save current Focus position, and extend the selection one char.
     nsINode* focusNode = selection->GetFocusNode();
     uint32_t focusOffset = selection->FocusOffset();
     selection->Modify(NS_LITERAL_STRING("extend"),
                       aDirection,
                       NS_LITERAL_STRING("character"));