angler-fishThe Vulnerability History Project

Composited selection bounds should not crash on detached iframes

      The composted selection bounds code assumed that every renderer in the system
will be backed by a backing. This is wrong because a detached frame's root
layer does not always exist and the renderer can't use backing from the parent
frame.

Frames can have a render tree but be detached from the root tree if the owner
frame has no renderer due to display:none on the parent chain. See the
attached bug for an example.

This CL adds proper safeguards to selection handle code to detect nonexistence
of layer backing, and return empty handle in such case.

BUG=453903

Review URL: https://codereview.chromium.org/892723002

git-svn-id: svn://svn.chromium.org/blink/trunk@189294 bbb929c8-8fbe-4397-9dbb-9b2b20218538
    
commit d0b3ad301cb6524a5fa8965909700d6f3be75dc9
+1 -1
+1 -6
-2
-4
expand_less