Store InputType in a Ref before calling setValueAsDecimal

rwlbuis · webkit-commit-queue · commit a742ecc53374 · 2021-04-11T14:35:46.000Z
https://bugs.webkit.org/show_bug.cgi?id=223535 Patch by Rob Buis <rbuis@igalia.com> on 2021-04-11 Reviewed by Ryosuke Niwa. Store InputType in a Ref before calling setValueAsDecimal. * html/InputType.cpp: (WebCore::InputType::applyStep): Canonical link: https://commits.webkit.org/236378@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@275807 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
@@ -1,3 +1,15 @@
+2021-04-11  Rob Buis  <rbuis@igalia.com>
+
+        Store InputType in a Ref before calling setValueAsDecimal
+        https://bugs.webkit.org/show_bug.cgi?id=223535
+
+        Reviewed by Ryosuke Niwa.
+
+        Store InputType in a Ref before calling setValueAsDecimal.
+
+        * html/InputType.cpp:
+        (WebCore::InputType::applyStep):
+
 2021-04-10  Chris Dumez  <cdumez@apple.com>
 
         Regression(r275668) Potential null pointer deref in AudioParam::exponentialRampToValueAtTime(float, double)
diff --git a/Source/WebCore/html/InputType.cpp b/Source/WebCore/html/InputType.cpp
@@ -930,8 +930,9 @@ ExceptionOr<void> InputType::applyStep(int count, AnyStepHandling anyStepHandlin
     if (newValue > stepRange.maximum())
         newValue = stepRange.maximum();
 
+    auto protectedThis = makeRef(*this);
     auto result = setValueAsDecimal(newValue, eventBehavior);
-    if (result.hasException())
+    if (result.hasException() || !element())
         return result;
 
     if (AXObjectCache* cache = element()->document().existingAXObjectCache())
