Crash in IsolateTracker::addFakeRunIfNecessary(), preceded by assertion failure ...
authorrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 29 Nov 2011 20:37:24 +0000 (20:37 +0000)
committerrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 29 Nov 2011 20:37:24 +0000 (20:37 +0000)
commit8ac58adfbb1ea8f1b176a1e637289afa64570e83
treec84485e332c5b1f89cbd807bc0e6f666dc97e0dd
parent7d0461b50dfabf379257c0d136a5375ef72b11b9
Crash in IsolateTracker::addFakeRunIfNecessary(), preceded by assertion failure (m_nestedIsolateCount >= 1)
in IsolateTracker::exitIsolate()
https://bugs.webkit.org/show_bug.cgi?id=69275

Reviewed by Eric Seidel.

Source/WebCore:

The crash was caused by our false assumption that at most one isolated container exists between the start
and the root when appending a new run. Fixed the crash by computing the actual number of isolated containers
between the start and the root.

Test: fast/text/nested-bidi-isolate-crash.html

* rendering/InlineIterator.h:
(WebCore::numberOfIsolateAncestors):
(WebCore::IsolateTracker::IsolateTracker):
(WebCore::InlineBidiResolver::appendRun):

LayoutTests:

Add a regression test.

* fast/text/nested-bidi-isolate-crash-expected.txt: Added.
* fast/text/nested-bidi-isolate-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@101406 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/text/nested-bidi-isolate-crash-expected.txt [new file with mode: 0644]
LayoutTests/fast/text/nested-bidi-isolate-crash.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/rendering/InlineIterator.h