[webkit-changes] [145585] branches/safari-536.30-branch/Source/WebCore

Tue, 12 Mar 2013 14:37:55 -0700

Title: [145585] branches/safari-536.30-branch/Source/WebCore

Diff

Modified: branches/safari-536.30-branch/Source/WebCore/ChangeLog (145584 => 145585)


--- branches/safari-536.30-branch/Source/WebCore/ChangeLog	2013-03-12 21:29:01 UTC (rev 145584)
+++ branches/safari-536.30-branch/Source/WebCore/ChangeLog	2013-03-12 21:39:51 UTC (rev 145585)
@@ -1,5 +1,36 @@
 2013-03-12  Lucas Forschler  <[email protected]>
 
+        Merge r129144
+
+    2012-09-20  Levi Weintraub  <[email protected]>
+
+            Prevent reading stale data from InlineTextBoxes
+            https://bugs.webkit.org/show_bug.cgi?id=94750
+
+            Reviewed by Eric Seidel.
+
+            Text from dirty InlineTextBoxes should never be read or used. This change enforces this
+            design goal by forcefully zero-ing out the start and length of InlineTextBoxes when 
+            they're being marked dirty. It also adds asserts to accessors for those members.
+
+            This change involves making markDirty virtual. Running the line-layout performance test
+            as well as profiling resizing the html5 spec showed negligable impact with this change.
+
+            No new tests as this doesn't change any proper behavior.
+
+            * rendering/InlineBox.h:
+            (WebCore::InlineBox::markDirty): Making virtual to allow InlineTextBox to overload and
+            zero out its start and length.
+            * rendering/InlineTextBox.cpp:
+            (WebCore::InlineTextBox::markDirty): Zeroing out start and length when we mark the box dirty.
+            * rendering/InlineTextBox.h:
+            (WebCore::InlineTextBox::start): Adding an assert when we hit this case.
+            (WebCore::InlineTextBox::end): Ditto.
+            (WebCore::InlineTextBox::len): Ditto.
+            (WebCore::InlineTextBox::offsetRun): Ditto.
+
+2013-03-12  Lucas Forschler  <[email protected]>
+
         Merge r128524
 
     2012-09-13  Tom Sepez  <[email protected]>

Modified: branches/safari-536.30-branch/Source/WebCore/rendering/InlineBox.h (145584 => 145585)


--- branches/safari-536.30-branch/Source/WebCore/rendering/InlineBox.h	2013-03-12 21:29:01 UTC (rev 145584)
+++ branches/safari-536.30-branch/Source/WebCore/rendering/InlineBox.h	2013-03-12 21:39:51 UTC (rev 145585)
@@ -255,7 +255,7 @@
     virtual void clearTruncation() { }
 
     bool isDirty() const { return m_bitfields.dirty(); }
-    void markDirty(bool dirty = true) { m_bitfields.setDirty(dirty); }
+    virtual void markDirty(bool dirty = true) { m_bitfields.setDirty(dirty); }
 
     virtual void dirtyLineBoxes();

Modified: branches/safari-536.30-branch/Source/WebCore/rendering/InlineTextBox.cpp (145584 => 145585)


--- branches/safari-536.30-branch/Source/WebCore/rendering/InlineTextBox.cpp	2013-03-12 21:29:01 UTC (rev 145584)
+++ branches/safari-536.30-branch/Source/WebCore/rendering/InlineTextBox.cpp	2013-03-12 21:39:51 UTC (rev 145585)
@@ -64,6 +64,15 @@
     InlineBox::destroy(arena);
 }
 
+void InlineTextBox::markDirty(bool dirty)
+{
+    if (dirty) {
+        m_len = 0;
+        m_start = 0;
+    }
+    InlineBox::markDirty(dirty);
+}
+
 LayoutRect InlineTextBox::logicalOverflowRect() const
 {
     if (knownToHaveNoOverflow() || !gTextBoxesWithOverflow)

Modified: branches/safari-536.30-branch/Source/WebCore/rendering/InlineTextBox.h (145584 => 145585)


--- branches/safari-536.30-branch/Source/WebCore/rendering/InlineTextBox.h	2013-03-12 21:29:01 UTC (rev 145584)
+++ branches/safari-536.30-branch/Source/WebCore/rendering/InlineTextBox.h	2013-03-12 21:39:51 UTC (rev 145585)
@@ -64,17 +64,19 @@
     void setNextTextBox(InlineTextBox* n) { m_nextTextBox = n; }
     void setPreviousTextBox(InlineTextBox* p) { m_prevTextBox = p; }
 
-    unsigned start() const { return m_start; }
-    unsigned end() const { return m_len ? m_start + m_len - 1 : m_start; }
-    unsigned len() const { return m_len; }
+    unsigned start() const { ASSERT(!isDirty()); return m_start; }
+    unsigned end() const { ASSERT(!isDirty()); return m_len ? m_start + m_len - 1 : m_start; }
+    unsigned len() const { ASSERT(!isDirty()); return m_len; }
 
     void setStart(unsigned start) { m_start = start; }
     void setLen(unsigned len) { m_len = len; }
 
-    void offsetRun(int d) { m_start += d; }
+    void offsetRun(int d) { ASSERT(!isDirty()); m_start += d; }
 
     unsigned short truncation() { return m_truncation; }
 
+    virtual void markDirty(bool dirty = true) OVERRIDE;
+
     using InlineBox::hasHyphen;
     using InlineBox::setHasHyphen;
     using InlineBox::canHaveLeadingExpansion;

_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to