[Webkit-unassigned] [Bug 205290] Null Ptr Deref in WebCore::findPlaceForCounter

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=205290

--- Comment #2 from Jack <shihchieh_lee at apple.com> ---
Cause of the crash:

Function parentOrPseudoHostElement() finds an element that does not contain renderer, causing the caller (findPlaceForCounter) to use nullptr as current render and try to dereference it.

Fix:
In function parentOrPseudoHostElement(), search the whole renderer tree for an element that has a parent with "hasDisplayContents" set to false.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20191216/5fc3ada0/attachment.htm>