tree 3d87696f74b53dad24b423adc8ba396af4ce7a6b
parent 0cd9ea7c332f22e34d71322b3254986fa1e8e320
author shvaikalesh@gmail.com <shvaikalesh@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1643157098 +0000
committer shvaikalesh@gmail.com <shvaikalesh@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1643157098 +0000

XPath::Step::nodesInAxis(): add null checks after Attr::ownerElement() calls
https://bugs.webkit.org/show_bug.cgi?id=235500

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Import WPT tests from https://github.com/web-platform-tests/wpt/pull/32544.

* web-platform-tests/domxpath/xpath-evaluate-crash-expected.txt: Added.
* web-platform-tests/domxpath/xpath-evaluate-crash.html: Added.

Source/WebCore:

This patch adds null checks for results of Attr::ownerElement() to avoid crashes
when evaluating XPath expressions with an orphaned Attr as the context node.

Inspired by the recent Blink fix [1], yet this change covers all null pointer
dereferencing sites, as proven by the updated test.

[1] https://bugs.chromium.org/p/chromium/issues/detail?id=1236967

Test: imported/w3c/web-platform-tests/domxpath/xpath-evaluate-crash.html

* xml/XPathStep.cpp:
(WebCore::XPath::Step::nodesInAxis const):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@288589 268f45cc-cd09-0410-ab3c-d52691b4dbfc