Title: [110640] trunk
- Revision
- 110640
- Author
- [email protected]
- Date
- 2012-03-13 16:45:53 -0700 (Tue, 13 Mar 2012)
Log Message
MathML crash in WebCore::Node::previousSibling()
https://bugs.webkit.org/show_bug.cgi?id=80773
Patch by Jacky Jiang <[email protected]> on 2012-03-13
Reviewed by Julien Chaffraix.
Source/WebCore:
When adding child for msub render, if the child is mtr or mtd render,
we will creat an anonymous render as the container. As the anonymous
render's node is 0, accessing it directly can cause crash.
We should do a valid check of the node before using. In addition to
that, for msub, attach the anonymous render and it's children to render
tree. For msubsup, such kind of situation should never happen based on
the current codebase.
Test: mathml/msub-anonymous-child-render-crash.html
* rendering/mathml/RenderMathMLSubSup.cpp:
(WebCore::RenderMathMLSubSup::addChild):
LayoutTests:
* mathml/msub-anonymous-child-render-crash-expected.txt: Added.
* mathml/msub-anonymous-child-render-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (110639 => 110640)
--- trunk/LayoutTests/ChangeLog 2012-03-13 23:43:07 UTC (rev 110639)
+++ trunk/LayoutTests/ChangeLog 2012-03-13 23:45:53 UTC (rev 110640)
@@ -1,3 +1,13 @@
+2012-03-13 Jacky Jiang <[email protected]>
+
+ MathML crash in WebCore::Node::previousSibling()
+ https://bugs.webkit.org/show_bug.cgi?id=80773
+
+ Reviewed by Julien Chaffraix.
+
+ * mathml/msub-anonymous-child-render-crash-expected.txt: Added.
+ * mathml/msub-anonymous-child-render-crash.html: Added.
+
2012-03-13 Mihnea Ovidenie <[email protected]>
[CSSRegions]NamedFlow::getRegionsByContentNode should not return a live NodeList
Added: trunk/LayoutTests/mathml/msub-anonymous-child-render-crash-expected.txt (0 => 110640)
--- trunk/LayoutTests/mathml/msub-anonymous-child-render-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/mathml/msub-anonymous-child-render-crash-expected.txt 2012-03-13 23:45:53 UTC (rev 110640)
@@ -0,0 +1,7 @@
+This test passes if it does not crash.
+
+X
+3
+Y3X
+3
+2Y32
Added: trunk/LayoutTests/mathml/msub-anonymous-child-render-crash.html (0 => 110640)
--- trunk/LayoutTests/mathml/msub-anonymous-child-render-crash.html (rev 0)
+++ trunk/LayoutTests/mathml/msub-anonymous-child-render-crash.html 2012-03-13 23:45:53 UTC (rev 110640)
@@ -0,0 +1,29 @@
+<html>
+<script>
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+</script>
+<body>
+<p>This test passes if it does not crash.</p>
+<math xmlns="http://www.w3.org/1998/Math/MathML">
+ <msub>
+ <mi>X</mi>
+ <mtr>3</mtr>
+ </msub>
+ <msub>
+ <mi>Y</mi>
+ <mtd>3</mtd>
+ </msub>
+ <msubsup>
+ <mi>X</mi>
+ <mtr>3</mtr>
+ <mn>2</mn>
+ </msubsup>
+ <msubsup>
+ <mi>Y</mi>
+ <mtd>3</mtd>
+ <mn>2</mn>
+ </msubsup>
+</math>
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (110639 => 110640)
--- trunk/Source/WebCore/ChangeLog 2012-03-13 23:43:07 UTC (rev 110639)
+++ trunk/Source/WebCore/ChangeLog 2012-03-13 23:45:53 UTC (rev 110640)
@@ -1,3 +1,23 @@
+2012-03-13 Jacky Jiang <[email protected]>
+
+ MathML crash in WebCore::Node::previousSibling()
+ https://bugs.webkit.org/show_bug.cgi?id=80773
+
+ Reviewed by Julien Chaffraix.
+
+ When adding child for msub render, if the child is mtr or mtd render,
+ we will creat an anonymous render as the container. As the anonymous
+ render's node is 0, accessing it directly can cause crash.
+ We should do a valid check of the node before using. In addition to
+ that, for msub, attach the anonymous render and it's children to render
+ tree. For msubsup, such kind of situation should never happen based on
+ the current codebase.
+
+ Test: mathml/msub-anonymous-child-render-crash.html
+
+ * rendering/mathml/RenderMathMLSubSup.cpp:
+ (WebCore::RenderMathMLSubSup::addChild):
+
2012-03-13 Mihnea Ovidenie <[email protected]>
[CSSRegions]NamedFlow::getRegionsByContentNode should not return a live NodeList
Modified: trunk/Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp (110639 => 110640)
--- trunk/Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp 2012-03-13 23:43:07 UTC (rev 110639)
+++ trunk/Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp 2012-03-13 23:45:53 UTC (rev 110640)
@@ -68,7 +68,7 @@
// Note: The RenderMathMLBlock only allows element children to be added.
Element* childElement = toElement(child->node());
- if (!childElement->previousElementSibling()) {
+ if (childElement && !childElement->previousElementSibling()) {
// Position 1 is always the base of the msub/msup/msubsup.
RenderMathMLBlock* wrapper = new (renderArena()) RenderMathMLBlock(node());
RefPtr<RenderStyle> wrapperStyle = RenderStyle::create();
@@ -95,6 +95,10 @@
}
} else {
if (m_kind == SubSup) {
+ ASSERT(childElement);
+ if (!childElement)
+ return;
+
RenderBlock* script = new (renderArena()) RenderMathMLBlock(node());
RefPtr<RenderStyle> scriptStyle = RenderStyle::create();
scriptStyle->inheritFrom(m_scripts->style());
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
