Title: [125503] trunk
- Revision
- 125503
- Author
- [email protected]
- Date
- 2012-08-13 19:52:03 -0700 (Mon, 13 Aug 2012)
Log Message
Crash in WebCore::RenderBlock::LineBreaker::nextLineBreak
https://bugs.webkit.org/show_bug.cgi?id=93806
Patch by Douglas Stockwell <[email protected]> on 2012-08-13
Reviewed by Abhishek Arya.
Source/WebCore:
When looking for line breaks on the first line, existing code was
checking for text-combine only in the first-line style. Since
text-combine isn't inherited this resulted in a line break being
chosen before combineText was called. When this happened and then
combineText was called subsequently, the position of the line break
iterator would be invalid.
This patch changes the check to use the regular style as in
skipLeadingWhitespace and textWidth.
Test: fast/text/text-combine-first-line-crash.html
* rendering/RenderBlockLineLayout.cpp:
(WebCore::RenderBlock::LineBreaker::nextLineBreak): Don't use the
first-line style when checking text-combine.
LayoutTests:
* fast/text/text-combine-first-line-crash-expected.txt: Added.
* fast/text/text-combine-first-line-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (125502 => 125503)
--- trunk/LayoutTests/ChangeLog 2012-08-14 02:49:44 UTC (rev 125502)
+++ trunk/LayoutTests/ChangeLog 2012-08-14 02:52:03 UTC (rev 125503)
@@ -1,3 +1,13 @@
+2012-08-13 Douglas Stockwell <[email protected]>
+
+ Crash in WebCore::RenderBlock::LineBreaker::nextLineBreak
+ https://bugs.webkit.org/show_bug.cgi?id=93806
+
+ Reviewed by Abhishek Arya.
+
+ * fast/text/text-combine-first-line-crash-expected.txt: Added.
+ * fast/text/text-combine-first-line-crash.html: Added.
+
2012-08-13 Yuta Kitamura <[email protected]>
[Chromium] Unreviewed. Rebaseline test results for add-table-overpaint.html.
Added: trunk/LayoutTests/fast/text/text-combine-first-line-crash-expected.txt (0 => 125503)
--- trunk/LayoutTests/fast/text/text-combine-first-line-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/text/text-combine-first-line-crash-expected.txt 2012-08-14 02:52:03 UTC (rev 125503)
@@ -0,0 +1 @@
+This test passes if it does not CRASH.
Added: trunk/LayoutTests/fast/text/text-combine-first-line-crash.html (0 => 125503)
--- trunk/LayoutTests/fast/text/text-combine-first-line-crash.html (rev 0)
+++ trunk/LayoutTests/fast/text/text-combine-first-line-crash.html 2012-08-14 02:52:03 UTC (rev 125503)
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<style>
+#test {
+ -webkit-text-combine: horizontal;
+ -webkit-writing-mode: vertical-rl;
+ height: 0px;
+}
+#test::first-line {
+ color: black;
+}
+</style>
+This test passes if it does not CRASH.
+<span id="test">'''
+</span>
+<script>
+document.documentElement.offsetTop;
+test.innerText = '';
+if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (125502 => 125503)
--- trunk/Source/WebCore/ChangeLog 2012-08-14 02:49:44 UTC (rev 125502)
+++ trunk/Source/WebCore/ChangeLog 2012-08-14 02:52:03 UTC (rev 125503)
@@ -1,3 +1,26 @@
+2012-08-13 Douglas Stockwell <[email protected]>
+
+ Crash in WebCore::RenderBlock::LineBreaker::nextLineBreak
+ https://bugs.webkit.org/show_bug.cgi?id=93806
+
+ Reviewed by Abhishek Arya.
+
+ When looking for line breaks on the first line, existing code was
+ checking for text-combine only in the first-line style. Since
+ text-combine isn't inherited this resulted in a line break being
+ chosen before combineText was called. When this happened and then
+ combineText was called subsequently, the position of the line break
+ iterator would be invalid.
+
+ This patch changes the check to use the regular style as in
+ skipLeadingWhitespace and textWidth.
+
+ Test: fast/text/text-combine-first-line-crash.html
+
+ * rendering/RenderBlockLineLayout.cpp:
+ (WebCore::RenderBlock::LineBreaker::nextLineBreak): Don't use the
+ first-line style when checking text-combine.
+
2012-08-13 Kwang Yul Seo <[email protected]>
Remove unused method HTMLDocumentParser::script()
Modified: trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp (125502 => 125503)
--- trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp 2012-08-14 02:49:44 UTC (rev 125502)
+++ trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp 2012-08-14 02:52:03 UTC (rev 125503)
@@ -2333,10 +2333,10 @@
bool isSVGText = t->isSVGInlineText();
#endif
- RenderStyle* style = t->style(lineInfo.isFirstLine());
- if (style->hasTextCombine() && current.m_obj->isCombineText() && !toRenderCombineText(current.m_obj)->isCombined())
+ if (t->style()->hasTextCombine() && current.m_obj->isCombineText() && !toRenderCombineText(current.m_obj)->isCombined())
toRenderCombineText(current.m_obj)->combineText();
+ RenderStyle* style = t->style(lineInfo.isFirstLine());
const Font& f = style->font();
bool isFixedPitch = f.isFixedPitch();
bool canHyphenate = style->hyphens() == HyphensAuto && WebCore::canHyphenate(style->locale());
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
