Bug 1283828 - Null check content in RestrictCaretDraggingOffsets. draft
authorTing-Yu Lin <tlin@mozilla.com>
Sun, 03 Jul 2016 21:35:21 +0800
changeset 383383 eeeed5f8065a99ad491c0a557b7610a5b8e31802
parent 383328 39dffbba764210b25bfc1e749b4f16db77fa0d46
child 524457 5bf828551dd65bf8e30d2644949e2fc019e0759c
push id22003
push usertlin@mozilla.com
push dateSun, 03 Jul 2016 13:36:20 +0000
bugs1283828
milestone50.0a1
Bug 1283828 - Null check content in RestrictCaretDraggingOffsets. Passing null content to nsContentUtils::ComparePoints will lead to a crash. MozReview-Commit-ID: 3rS2Qxv4X1E
layout/base/AccessibleCaretManager.cpp
--- a/layout/base/AccessibleCaretManager.cpp
+++ b/layout/base/AccessibleCaretManager.cpp
@@ -1027,16 +1027,19 @@ AccessibleCaretManager::RestrictCaretDra
   nsIFrame* frame =
     GetFrameForFirstRangeStartOrLastRangeEnd(dir, &offset, &node, &contentOffset);
 
   if (!frame) {
     return false;
   }
 
   nsCOMPtr<nsIContent> content = do_QueryInterface(node);
+  if (!content) {
+    return false;
+  }
 
   // Compare the active caret's new position (aOffsets) to the inactive caret's
   // position.
   int32_t cmpToInactiveCaretPos =
     nsContentUtils::ComparePoints(aOffsets.content, aOffsets.StartOffset(),
                                   content, contentOffset);
 
   // Move one character (in the direction of dir) from the inactive caret's