ASSERTION FAILED: v.isFixed() in WebCore::RenderStyle::setWordSpacing

https://bugs.webkit.org/show_bug.cgi?id=126987

Reviewed by Simon Fraser.

When "inherit" is specified and there is no parent, Length values have an "Auto" type

Source/WebCore:

Test: fast/css3-text/css3-word-spacing-percentage/word-spacing-crash.html

* rendering/style/RenderStyle.cpp:
(WebCore::RenderStyle::setWordSpacing):

LayoutTests:

* fast/css3-text/css3-word-spacing-percentage/word-spacing-crash-expected.txt: Added.
* fast/css3-text/css3-word-spacing-percentage/word-spacing-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@162588 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index fe16129..f8e1873 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,15 @@
+2014-01-22  Myles C. Maxfield  <mmaxfield@apple.com>
+
+        ASSERTION FAILED: v.isFixed() in WebCore::RenderStyle::setWordSpacing
+        https://bugs.webkit.org/show_bug.cgi?id=126987
+
+        Reviewed by Simon Fraser.
+
+        When "inherit" is specified and there is no parent, Length values have an "Auto" type
+
+        * fast/css3-text/css3-word-spacing-percentage/word-spacing-crash-expected.txt: Added.
+        * fast/css3-text/css3-word-spacing-percentage/word-spacing-crash.html: Added.
+
 2014-01-22  Samuel White  <samuel_white@apple.com>
 
         AX: Can't always increment web sliders.

diff --git a/LayoutTests/fast/css3-text/css3-word-spacing-percentage/word-spacing-crash-expected.txt b/LayoutTests/fast/css3-text/css3-word-spacing-percentage/word-spacing-crash-expected.txt
new file mode 100644 (file)
index 0000000..157e0e7
--- /dev/null
+++ b/LayoutTests/fast/css3-text/css3-word-spacing-percentage/word-spacing-crash-expected.txt
@@ -0,0 +1 @@
+This test makes sure that if "inherit" is specified on the word-spacing element when there is no parent element, there is no crash

diff --git a/LayoutTests/fast/css3-text/css3-word-spacing-percentage/word-spacing-crash.html b/LayoutTests/fast/css3-text/css3-word-spacing-percentage/word-spacing-crash.html
new file mode 100644 (file)
index 0000000..9d4fd12
--- /dev/null
+++ b/LayoutTests/fast/css3-text/css3-word-spacing-percentage/word-spacing-crash.html
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" word-spacing="inherit"></svg>
+This test makes sure that if "inherit" is specified on the word-spacing element when there is no parent element, there is no crash
+<script>
+if (window.testRunner) {
+    testRunner.dumpAsText();
+}
+</script>

diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 9dc7eb9..b6858b3 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,17 @@
+2014-01-22  Myles C. Maxfield  <mmaxfield@apple.com>
+
+        ASSERTION FAILED: v.isFixed() in WebCore::RenderStyle::setWordSpacing
+        https://bugs.webkit.org/show_bug.cgi?id=126987
+
+        Reviewed by Simon Fraser.
+
+        When "inherit" is specified and there is no parent, Length values have an "Auto" type
+
+        Test: fast/css3-text/css3-word-spacing-percentage/word-spacing-crash.html
+
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::setWordSpacing):
+
 2014-01-22  Samuel White  <samuel_white@apple.com>
 
         AX: Can't always increment web sliders.

diff --git a/Source/WebCore/rendering/style/RenderStyle.cpp b/Source/WebCore/rendering/style/RenderStyle.cpp
index cb71bb6..7f6fa5e 100644 (file)
--- a/Source/WebCore/rendering/style/RenderStyle.cpp
+++ b/Source/WebCore/rendering/style/RenderStyle.cpp
@@ -1453,11 +1453,19 @@ int RenderStyle::computedLineHeight(RenderView* renderView) const
 void RenderStyle::setWordSpacing(Length v)
 {
     float fontWordSpacing;
-    if (v.isPercent())
+    switch (v.type()) {
+    case Auto:
+        fontWordSpacing = 0;
+    case Percent:
         fontWordSpacing = v.getFloatValue() * font().spaceWidth() / 100;
-    else {
-        ASSERT(v.isFixed());
+        break;
+    case Fixed:
         fontWordSpacing = v.getFloatValue();
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+        fontWordSpacing = 0;
+        break;
     }
     inherited.access()->font.setWordSpacing(fontWordSpacing);
     rareInheritedData.access()->wordSpacing = std::move(v);