Title: [129147] branches/chromium/1229/Source/WebCore/rendering
- Revision
- 129147
- Author
- [email protected]
- Date
- 2012-09-20 11:27:46 -0700 (Thu, 20 Sep 2012)
Log Message
Merge 129144 - Prevent reading stale data from InlineTextBoxes
https://bugs.webkit.org/show_bug.cgi?id=94750
Reviewed by Eric Seidel.
Text from dirty InlineTextBoxes should never be read or used. This change enforces this
design goal by forcefully zero-ing out the start and length of InlineTextBoxes when
they're being marked dirty. It also adds asserts to accessors for those members.
This change involves making markDirty virtual. Running the line-layout performance test
as well as profiling resizing the html5 spec showed negligable impact with this change.
No new tests as this doesn't change any proper behavior.
* rendering/InlineBox.h:
(WebCore::InlineBox::markDirty): Making virtual to allow InlineTextBox to overload and
zero out its start and length.
* rendering/InlineTextBox.cpp:
(WebCore::InlineTextBox::markDirty): Zeroing out start and length when we mark the box dirty.
* rendering/InlineTextBox.h:
(WebCore::InlineTextBox::start): Adding an assert when we hit this case.
(WebCore::InlineTextBox::end): Ditto.
(WebCore::InlineTextBox::len): Ditto.
(WebCore::InlineTextBox::offsetRun): Ditto.
[email protected]
Review URL: https://codereview.chromium.org/10970020
Modified Paths
Diff
Modified: branches/chromium/1229/Source/WebCore/rendering/InlineBox.h (129146 => 129147)
--- branches/chromium/1229/Source/WebCore/rendering/InlineBox.h 2012-09-20 18:27:15 UTC (rev 129146)
+++ branches/chromium/1229/Source/WebCore/rendering/InlineBox.h 2012-09-20 18:27:46 UTC (rev 129147)
@@ -262,7 +262,7 @@
virtual void clearTruncation() { }
bool isDirty() const { return m_bitfields.dirty(); }
- void markDirty(bool dirty = true) { m_bitfields.setDirty(dirty); }
+ virtual void markDirty(bool dirty = true) { m_bitfields.setDirty(dirty); }
virtual void dirtyLineBoxes();
Modified: branches/chromium/1229/Source/WebCore/rendering/InlineTextBox.cpp (129146 => 129147)
--- branches/chromium/1229/Source/WebCore/rendering/InlineTextBox.cpp 2012-09-20 18:27:15 UTC (rev 129146)
+++ branches/chromium/1229/Source/WebCore/rendering/InlineTextBox.cpp 2012-09-20 18:27:46 UTC (rev 129147)
@@ -64,6 +64,15 @@
InlineBox::destroy(arena);
}
+void InlineTextBox::markDirty(bool dirty)
+{
+ if (dirty) {
+ m_len = 0;
+ m_start = 0;
+ }
+ InlineBox::markDirty(dirty);
+}
+
LayoutRect InlineTextBox::logicalOverflowRect() const
{
if (knownToHaveNoOverflow() || !gTextBoxesWithOverflow)
Modified: branches/chromium/1229/Source/WebCore/rendering/InlineTextBox.h (129146 => 129147)
--- branches/chromium/1229/Source/WebCore/rendering/InlineTextBox.h 2012-09-20 18:27:15 UTC (rev 129146)
+++ branches/chromium/1229/Source/WebCore/rendering/InlineTextBox.h 2012-09-20 18:27:46 UTC (rev 129147)
@@ -64,17 +64,19 @@
void setNextTextBox(InlineTextBox* n) { m_nextTextBox = n; }
void setPreviousTextBox(InlineTextBox* p) { m_prevTextBox = p; }
- unsigned start() const { return m_start; }
- unsigned end() const { return m_len ? m_start + m_len - 1 : m_start; }
- unsigned len() const { return m_len; }
+ unsigned start() const { ASSERT(!isDirty()); return m_start; }
+ unsigned end() const { ASSERT(!isDirty()); return m_len ? m_start + m_len - 1 : m_start; }
+ unsigned len() const { ASSERT(!isDirty()); return m_len; }
void setStart(unsigned start) { m_start = start; }
void setLen(unsigned len) { m_len = len; }
- void offsetRun(int d) { m_start += d; }
+ void offsetRun(int d) { ASSERT(!isDirty()); m_start += d; }
unsigned short truncation() { return m_truncation; }
+ virtual void markDirty(bool dirty = true) OVERRIDE;
+
using InlineBox::hasHyphen;
using InlineBox::setHasHyphen;
using InlineBox::canHaveLeadingExpansion;
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
