Changeset 255113 in webkit for trunk/Source/WebCore/rendering/RenderMultiColumnFlow.cpp

Timestamp:

Jan 24, 2020, 5:37:20 PM (5 years ago)

Author:

[email protected]

Message:

Null Ptr Deref READ @ WebCore::RenderMultiColumnFlow::lastMultiColumnSet const
​https://bugs.webkit.org/show_bug.cgi?id=206106

Patch by Jack Lee <Jack Lee> on 2020-01-24
Reviewed by Ryosuke Niwa.

Could not write a reproducible fast test case for this.

• rendering/RenderMultiColumnFlow.cpp:

(WebCore::RenderMultiColumnFlow::lastMultiColumnSet const):

• rendering/updating/RenderTreeBuilderMultiColumn.cpp:

(WebCore::RenderTreeBuilder::MultiColumn::processPossibleSpannerDescendant):

File:

• trunk/Source/WebCore/rendering/RenderMultiColumnFlow.cpp (modified) (1 diff)

trunk/Source/WebCore/rendering/RenderMultiColumnFlow.cpp

@@ -75 +75 @@
 RenderMultiColumnSet* RenderMultiColumnFlow::lastMultiColumnSet() const
 {
+    ASSERT(multiColumnBlockFlow());
+
     for (RenderObject* sibling = multiColumnBlockFlow()->lastChild(); sibling; sibling = sibling->previousSibling()) {
         if (is<RenderMultiColumnSet>(*sibling))