Reviewed by Darin.

        - fixed <rdar://problem/4058740> Crash (nil-deref) editing Mail reply
        message in KWQKHTMLPart::fontForSelection (MailViewer-723)

        * kwq/KWQKHTMLPart.mm:
        (KWQKHTMLPart::fontForSelection):
        Add nil check to loop. It shouldn't be necessary, but this crash trace seems to be
        running into it. We're not completely certain, but the check is harmless at worst.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@8932 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/WebCore/ChangeLog-2005-08-23 b/WebCore/ChangeLog-2005-08-23
index 4d7c2489e0f45ef04eab591b916123a937fe5b41..031e983fa5a9d5fe5ffea3c38978e18b53af2bfc 100644 (file)
--- a/WebCore/ChangeLog-2005-08-23
+++ b/WebCore/ChangeLog-2005-08-23
@@ -1,3 +1,15 @@
+2005-03-19  John Sullivan  <sullivan@apple.com>
+
+        Reviewed by Darin.
+        
+        - fixed <rdar://problem/4058740> Crash (nil-deref) editing Mail reply 
+        message in KWQKHTMLPart::fontForSelection (MailViewer-723)
+
+        * kwq/KWQKHTMLPart.mm:
+        (KWQKHTMLPart::fontForSelection):
+        Add nil check to loop. It shouldn't be necessary, but this crash trace seems to be
+        running into it. We're not completely certain, but the check is harmless at worst.
+
 === Safari-408 ===
 
 2005-03-18  David Harrison  <harrison@apple.com>

diff --git a/WebCore/kwq/KWQKHTMLPart.mm b/WebCore/kwq/KWQKHTMLPart.mm
index 73510c9ceac89531f33f7665f78f8ec1106105f2..4d76e112eeeac4af617f20c812fe27be32fa3f96 100644 (file)
--- a/WebCore/kwq/KWQKHTMLPart.mm
+++ b/WebCore/kwq/KWQKHTMLPart.mm
@@ -3530,7 +3530,9 @@ NSFont *KWQKHTMLPart::fontForSelection(bool *hasMultipleFonts) const
     NodeImpl *startNode = range->editingStartPosition().node();
     if (startNode != nil) {
         NodeImpl *pastEnd = range->pastEndNode();
-        for (NodeImpl *n = startNode; n != pastEnd; n = n->traverseNextNode()) {
+        // In the loop below, n should eventually match pastEnd and not become nil, but we've seen at least one
+        // unreproducible case where this didn't happen, so check for nil also.
+        for (NodeImpl *n = startNode; n && n != pastEnd; n = n->traverseNextNode()) {
             RenderObject *renderer = n->renderer();
             if (!renderer)
                 continue;