Changeset 272497 in webkit for trunk/Source/WebCore/css/CSSGradientValue.cpp

Timestamp:

Feb 8, 2021, 9:36:18 AM (4 years ago)

Author:

[email protected]

Message:

Null check document element in createGradient
​https://bugs.webkit.org/show_bug.cgi?id=221378

Patch by Rob Buis <​[email protected]> on 2021-02-08
Reviewed by Alex Christensen.

Source/WebCore:

The document element is not guaranteed to exist so null
check it before determining the root style.

Tests: fast/css/conic-gradient-no-document-element-crash.html

fast/css/linear-gradient-no-document-element-crash.html
fast/css/radial-gradient-no-document-element-crash.html

• css/CSSGradientValue.cpp:

(WebCore::CSSLinearGradientValue::createGradient):
(WebCore::CSSRadialGradientValue::createGradient):
(WebCore::CSSConicGradientValue::createGradient):

LayoutTests:

Add tests for this.

• fast/css/conic-gradient-no-document-element-crash-expected.txt: Added.
• fast/css/conic-gradient-no-document-element-crash.html: Added.
• fast/css/linear-gradient-no-document-element-crash-expected.txt: Added.
• fast/css/linear-gradient-no-document-element-crash.html: Added.
• fast/css/radial-gradient-no-document-element-crash-expected.txt: Added.
• fast/css/radial-gradient-no-document-element-crash.html: Added.

File:

• trunk/Source/WebCore/css/CSSGradientValue.cpp (modified) (3 diffs)

trunk/Source/WebCore/css/CSSGradientValue.cpp

@@ -807 +807 @@
     ASSERT(!size.isEmpty());
 
-    CSSToLengthConversionData conversionData(&renderer.style(), renderer.document().documentElement()->renderStyle(), renderer.parentStyle(), &renderer.view());
+    const RenderStyle* rootStyle = nullptr;
+    if (auto* documentElement = renderer.document().documentElement())
+        rootStyle = documentElement->renderStyle();
+
+    CSSToLengthConversionData conversionData(&renderer.style(), rootStyle, renderer.parentStyle(), &renderer.view());
 
     FloatPoint firstPoint;
@@ -1056 +1060 @@
     ASSERT(!size.isEmpty());
 
-    CSSToLengthConversionData conversionData(&renderer.style(), renderer.document().documentElement()->renderStyle(), renderer.parentStyle(), &renderer.view());
+    const RenderStyle* rootStyle = nullptr;
+    if (auto* documentElement = renderer.document().documentElement())
+        rootStyle = documentElement->renderStyle();
+
+    CSSToLengthConversionData conversionData(&renderer.style(), rootStyle, renderer.parentStyle(), &renderer.view());
 
     FloatPoint firstPoint = computeEndPoint(firstX(), firstY(), conversionData, size);
@@ -1247 +1255 @@
     ASSERT(!size.isEmpty());
 
-    CSSToLengthConversionData conversionData(&renderer.style(), renderer.document().documentElement()->renderStyle(), renderer.parentStyle(), &renderer.view());
+    const RenderStyle* rootStyle = nullptr;
+    if (auto* documentElement = renderer.document().documentElement())
+        rootStyle = documentElement->renderStyle();
+
+    CSSToLengthConversionData conversionData(&renderer.style(), rootStyle, renderer.parentStyle(), &renderer.view());
 
     FloatPoint centerPoint = computeEndPoint(firstX(), firstY(), conversionData, size);