Don't let CSSPropertyWebkitPerspective dereference primitiveValue without null check.

https://bugs.webkit.org/show_bug.cgi?id=83538

Reviewed by Daniel Bates.

No new tests / code cleanup only.

Coverity pointed out that we potentially dereference primitiveValue here without checking for null.
I've added an early out for that case to make sure it can't ever happen. I don't know if it's actually
possible to exercise that code path or not - probably the parser prevents it from being hit in practice.

* css/CSSStyleSelector.cpp:
(WebCore::CSSStyleSelector::collectMatchingRulesForList):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@113676 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 2d31933..25fb055 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,19 @@
+2012-04-09  Luke Macpherson  <macpherson@chromium.org>
+
+        Don't let CSSPropertyWebkitPerspective dereference primitiveValue without null check.
+        https://bugs.webkit.org/show_bug.cgi?id=83538
+
+        Reviewed by Daniel Bates.
+
+        No new tests / code cleanup only.
+
+        Coverity pointed out that we potentially dereference primitiveValue here without checking for null.
+        I've added an early out for that case to make sure it can't ever happen. I don't know if it's actually
+        possible to exercise that code path or not - probably the parser prevents it from being hit in practice.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+
 2012-04-09  Joseph Pecoraro  <pecoraro@apple.com>
 
         <http://webkit.org/b/83539> Web Inspector: ASSERT attempting to unbind null contentDocument

diff --git a/Source/WebCore/css/CSSStyleSelector.cpp b/Source/WebCore/css/CSSStyleSelector.cpp
index 3b73a32..95d6d78 100644 (file)
--- a/Source/WebCore/css/CSSStyleSelector.cpp
+++ b/Source/WebCore/css/CSSStyleSelector.cpp
@@ -3643,7 +3643,11 @@ void CSSStyleSelector::applyProperty(CSSPropertyID id, CSSValue *value)
     }
     case CSSPropertyWebkitPerspective: {
         HANDLE_INHERIT_AND_INITIAL(perspective, Perspective)
-        if (primitiveValue && primitiveValue->getIdent() == CSSValueNone) {
+
+        if (!primitiveValue)
+            return;
+
+        if (primitiveValue->getIdent() == CSSValueNone) {
             m_style->setPerspective(0);
             return;
         }