From 324460324818d8c11892d690a58d5b7b37b2209d Mon Sep 17 00:00:00 2001
From: Chirag M Shah <chirag_m_shah@apple.com>
Date: Fri, 2 Dec 2022 11:23:12 -0800
Subject: [PATCH] Don't crash when RenderStyle is NULL for elements like
 optgroup when rendering https://bugs.webkit.org/show_bug.cgi?id=248575

Reviewed by Simon Fraser.

* LayoutTests/fast/rendering/render-style-null-optgroup-crash-expected.txt: Added.
* LayoutTests/fast/rendering/render-style-null-optgroup-crash.html: Added.
* Source/WebCore/rendering/RenderListBox.cpp:
(WebCore::RenderListBox::paintItemForeground):
(WebCore::RenderListBox::paintItemBackground):

Canonical link: https://commits.webkit.org/257295@main
---
 ...der-style-null-optgroup-crash-expected.txt |  1 +
 .../render-style-null-optgroup-crash.html     | 22 +++++++++++++++++++
 Source/WebCore/rendering/RenderListBox.cpp    | 20 ++++++++++-------
 3 files changed, 35 insertions(+), 8 deletions(-)
 create mode 100644 LayoutTests/fast/rendering/render-style-null-optgroup-crash-expected.txt
 create mode 100644 LayoutTests/fast/rendering/render-style-null-optgroup-crash.html

diff --git a/LayoutTests/fast/rendering/render-style-null-optgroup-crash-expected.txt b/LayoutTests/fast/rendering/render-style-null-optgroup-crash-expected.txt
new file mode 100644
index 0000000000000..7ef22e9a431ad
--- /dev/null
+++ b/LayoutTests/fast/rendering/render-style-null-optgroup-crash-expected.txt
@@ -0,0 +1 @@
+PASS
diff --git a/LayoutTests/fast/rendering/render-style-null-optgroup-crash.html b/LayoutTests/fast/rendering/render-style-null-optgroup-crash.html
new file mode 100644
index 0000000000000..f1710a5b6a9c2
--- /dev/null
+++ b/LayoutTests/fast/rendering/render-style-null-optgroup-crash.html
@@ -0,0 +1,22 @@
+<style>
+.class4:optional,*:focus-within { auto;display: contents }
+</style>
+<script>
+function f1() {
+    try { x = document.caretRangeFromPoint(); } catch { }
+    try { y = x.commonAncestorContainer; } catch { }
+    try { z.selectionDirection = "backward"; } catch { }
+    try { y.innerHTML = "PASS"; } catch { }
+}
+
+if (window.testRunner) {
+    testRunner.dumpAsText();
+}
+
+</script>
+<iframe translate="yes">
+</iframe>
+<details open="" onfocusin="f1()">
+<select autofocus="" multiple="" required="">
+<optgroup webkitdropzone="copy">
+<textarea id="z" rows="1024">
diff --git a/Source/WebCore/rendering/RenderListBox.cpp b/Source/WebCore/rendering/RenderListBox.cpp
index 990a09a5052e0..2f7fdee80e2ab 100644
--- a/Source/WebCore/rendering/RenderListBox.cpp
+++ b/Source/WebCore/rendering/RenderListBox.cpp
@@ -451,9 +451,11 @@ void RenderListBox::paintItemForeground(PaintInfo& paintInfo, const LayoutPoint&
     const auto& listItems = selectElement().listItems();
     RefPtr listItemElement = listItems[listIndex].get();
 
-    auto& itemStyle = *listItemElement->computedStyle();
+    auto itemStyle = listItemElement->computedStyle();
+    if (!itemStyle)
+        return;
 
-    if (itemStyle.visibility() == Visibility::Hidden)
+    if (itemStyle->visibility() == Visibility::Hidden)
         return;
 
     String itemText;
@@ -467,7 +469,7 @@ void RenderListBox::paintItemForeground(PaintInfo& paintInfo, const LayoutPoint&
     if (itemText.isNull())
         return;
 
-    Color textColor = itemStyle.visitedDependentColorWithColorFilter(CSSPropertyColor);
+    Color textColor = itemStyle->visitedDependentColorWithColorFilter(CSSPropertyColor);
     if (isOptionElement && downcast<HTMLOptionElement>(*listItemElement).selected()) {
         if (frame().selection().isFocusedAndActive() && document().focusedElement() == &selectElement())
             textColor = theme().activeListBoxSelectionForegroundColor(styleColorOptions());
@@ -478,10 +480,10 @@ void RenderListBox::paintItemForeground(PaintInfo& paintInfo, const LayoutPoint&
 
     paintInfo.context().setFillColor(textColor);
 
-    TextRun textRun(itemText, 0, 0, ExpansionBehavior::allowRightOnly(), itemStyle.direction(), isOverride(itemStyle.unicodeBidi()), true);
+    TextRun textRun(itemText, 0, 0, ExpansionBehavior::allowRightOnly(), itemStyle->direction(), isOverride(itemStyle->unicodeBidi()), true);
     FontCascade itemFont = style().fontCascade();
     LayoutRect r = itemBoundingBoxRect(paintOffset, listIndex);
-    r.move(itemOffsetForAlignment(textRun, &itemStyle, itemFont, r));
+    r.move(itemOffsetForAlignment(textRun, itemStyle, itemFont, r));
 
     if (is<HTMLOptGroupElement>(*listItemElement)) {
         auto description = itemFont.fontDescription();
@@ -498,7 +500,9 @@ void RenderListBox::paintItemBackground(PaintInfo& paintInfo, const LayoutPoint&
 {
     const auto& listItems = selectElement().listItems();
     RefPtr listItemElement = listItems[listIndex].get();
-    auto& itemStyle = *listItemElement->computedStyle();
+    auto itemStyle = listItemElement->computedStyle();
+    if (!itemStyle)
+        return;
 
     Color backColor;
     if (is<HTMLOptionElement>(*listItemElement) && downcast<HTMLOptionElement>(*listItemElement).selected()) {
@@ -507,10 +511,10 @@ void RenderListBox::paintItemBackground(PaintInfo& paintInfo, const LayoutPoint&
         else
             backColor = theme().inactiveListBoxSelectionBackgroundColor(styleColorOptions());
     } else
-        backColor = itemStyle.visitedDependentColorWithColorFilter(CSSPropertyBackgroundColor);
+        backColor = itemStyle->visitedDependentColorWithColorFilter(CSSPropertyBackgroundColor);
 
     // Draw the background for this list box item
-    if (itemStyle.visibility() == Visibility::Hidden)
+    if (itemStyle->visibility() == Visibility::Hidden)
         return;
 
     LayoutRect itemRect = itemBoundingBoxRect(paintOffset, listIndex);