git://git.webkit.org / WebKit-https.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 89ea5d0)
Crash in previousLinePosition when moving into a root inline box without leaves
authorrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 31 Jan 2012 00:18:19 +0000 (00:18 +0000)
committerrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 31 Jan 2012 00:18:19 +0000 (00:18 +0000)
https://bugs.webkit.org/show_bug.cgi?id=76812

Reviewed by Enrica Casucci.

Source/WebCore:

The crash was caused by us assuming that every root inline box has at least one leaf,
which isn't true when we create inline boxes for an empty text run with margin, border, etc...

Test: editing/selection/move-into-empty-root-inline-box.html

* editing/visible_units.cpp:
(WebCore::previousLinePosition):
(WebCore::nextLinePosition):

LayoutTests:

Add a regression test for the crash. Unfortunately, we can only test previousLinePosition.

* editing/selection/move-into-empty-root-inline-box-expected.txt: Added.
* editing/selection/move-into-empty-root-inline-box.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@106298 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog patch | blob | history
LayoutTests/editing/selection/move-into-empty-root-inline-box-expected.txt [new file with mode: 0644] patch | blob
LayoutTests/editing/selection/move-into-empty-root-inline-box.html [new file with mode: 0644] patch | blob
Source/WebCore/ChangeLog patch | blob | history
Source/WebCore/editing/visible_units.cpp patch | blob | history

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 680d2d6b446d8d075ec4392e0184b8f123af7022..b28805b3681ad3c79440d8ba76024cb808bf1c02 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,15 @@
+2012-01-30  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Crash in previousLinePosition when moving into a root inline box without leaves
+        https://bugs.webkit.org/show_bug.cgi?id=76812
+
+        Reviewed by Enrica Casucci.
+
+        Add a regression test for the crash. Unfortunately, we can only test previousLinePosition.
+
+        * editing/selection/move-into-empty-root-inline-box-expected.txt: Added.
+        * editing/selection/move-into-empty-root-inline-box.html: Added.
+
 2012-01-30  Oliver Hunt  <oliver@apple.com>
 
         Unexpected syntax error
diff --git a/LayoutTests/editing/selection/move-into-empty-root-inline-box-expected.txt b/LayoutTests/editing/selection/move-into-empty-root-inline-box-expected.txt
new file mode 100644 (file)
index 0000000..3fc0d74
--- /dev/null
+++ b/LayoutTests/editing/selection/move-into-empty-root-inline-box-expected.txt
@@ -0,0 +1,2 @@
+
+This tests moving into an empty root inline boxes. The test passes as long as WebKit doesn't crash.
diff --git a/LayoutTests/editing/selection/move-into-empty-root-inline-box.html b/LayoutTests/editing/selection/move-into-empty-root-inline-box.html
new file mode 100644 (file)
index 0000000..90f33c2
--- /dev/null
+++ b/LayoutTests/editing/selection/move-into-empty-root-inline-box.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html><html><body><br><label style="margin-left: inherit;"></label><script>
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+getSelection().setPosition(document.querySelector('br'), 0);
+getSelection().modify("move","forward","paragraph");
+document.writeln("This tests moving into an empty root inline boxes. The test passes as long as WebKit doesn't crash.");
+
+</script></body></html>
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index fa9673df899708557cabf0071ee0635093c8e3c3..1b6f5d0c1159c1bbb4e5e6151f1b36cd7ab173f0 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,19 @@
+2012-01-30  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Crash in previousLinePosition when moving into a root inline box without leaves
+        https://bugs.webkit.org/show_bug.cgi?id=76812
+
+        Reviewed by Enrica Casucci.
+
+        The crash was caused by us assuming that every root inline box has at least one leaf,
+        which isn't true when we create inline boxes for an empty text run with margin, border, etc...
+
+        Test: editing/selection/move-into-empty-root-inline-box.html
+
+        * editing/visible_units.cpp:
+        (WebCore::previousLinePosition):
+        (WebCore::nextLinePosition):
+
 2012-01-30  Levi Weintraub  <leviw@chromium.org>
 
         !m_insideRegionPaint assertion in RenderRegion.cpp is invalid
diff --git a/Source/WebCore/editing/visible_units.cpp b/Source/WebCore/editing/visible_units.cpp
index 509fa1d1995c1c35e6bdf4d095505d3776088683..ece6f233f7a2816859b1bf9f472f0cdf86447e96 100644 (file)
--- a/Source/WebCore/editing/visible_units.cpp
+++ b/Source/WebCore/editing/visible_units.cpp
@@ -576,7 +576,7 @@ VisiblePosition previousLinePosition(const VisiblePosition &visiblePosition, int
         root = box->root()->prevRootBox();
         // We want to skip zero height boxes.
         // This could happen in case it is a TrailingFloatsRootInlineBox.
-        if (!root || !root->logicalHeight())
+        if (!root || !root->logicalHeight() || !root->firstLeafChild())
             root = 0;
     }
 
@@ -677,7 +677,7 @@ VisiblePosition nextLinePosition(const VisiblePosition &visiblePosition, int lin
         root = box->root()->nextRootBox();
         // We want to skip zero height boxes.
         // This could happen in case it is a TrailingFloatsRootInlineBox.
-        if (!root || !root->logicalHeight())
+        if (!root || !root->logicalHeight() || !root->firstLeafChild())
             root = 0;
     }
 
Mirror of the WebKit open source project from svn.webkit.org.