Redundant ellipsis box triggers ASSERT_WITH_SECURITY_IMPLICATION in InlineBox::parent().
authorzalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 19 May 2017 00:37:43 +0000 (00:37 +0000)
committerzalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 19 May 2017 00:37:43 +0000 (00:37 +0000)
commitf964e965509d5161d6e699b6af5979c82a185c81
treeb63f8afa528e4baa8efd93839b3c82087f175d46
parentb38e1c675fe7d09dc3e495591b97661ef6b0c5de
Redundant ellipsis box triggers ASSERT_WITH_SECURITY_IMPLICATION in InlineBox::parent().
https://bugs.webkit.org/show_bug.cgi?id=172309
<rdar://problem/32262357>

Reviewed by Simon Fraser.

Source/WebCore:

This patch stops the redundant ellipsis box trigger ASSERT_WITH_SECURITY_IMPLICATION.

In RootInlineBox::placeEllipsis we construct an ellipsis box and append it to a static HashMap which
keeps track of the ellipsis boxes on each line. However when the line already has an ellipsis, we
re-use the existing one and this newly constructed (but redundant) box gets destroyed as we return from this function.
In InlineBox's d'tor, we let the parent know that now it has a dangling child and we assert on it
later, while accessing the children list. However this redundant ellipsis box was never added to the line,
so the assertion hits incorrectly.

Test: fast/inline/redundant-ellipsis-triggers-assert-incorrectly.html

* rendering/EllipsisBox.cpp:
(WebCore::EllipsisBox::EllipsisBox):
* rendering/InlineBox.cpp:
(WebCore::InlineBox::invalidateParentChildList):
* rendering/InlineBox.h:
* rendering/RootInlineBox.cpp:
(WebCore::RootInlineBox::placeEllipsis): Use the newly created ellipsis box instead.

LayoutTests:

* fast/inline/redundant-ellipsis-triggers-assert-incorrectly-expected.txt: Added.
* fast/inline/redundant-ellipsis-triggers-assert-incorrectly.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@217079 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/inline/redundant-ellipsis-triggers-assert-incorrectly-expected.txt [new file with mode: 0644]
LayoutTests/fast/inline/redundant-ellipsis-triggers-assert-incorrectly.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/rendering/EllipsisBox.cpp
Source/WebCore/rendering/InlineBox.cpp
Source/WebCore/rendering/InlineBox.h
Source/WebCore/rendering/RootInlineBox.cpp