Changeset 101180 in webkit

Timestamp:

Nov 25, 2011, 12:21:06 PM (15 years ago)

Author:

rniwa@webkit.org

Message:

Crash in BidiRunList<Run>::replaceRunWithRuns with an empty bdi element
​https://bugs.webkit.org/show_bug.cgi?id=73116

Reviewed by Eric Seidel.

Source/WebCore:

The assertion failure was caused because isolatedResolver is initialized with
null start object due to the isolated run being empty.

Fixed the failure by skipping empty isolated runs.

Test: fast/text/empty-bdi-crash.html

• rendering/RenderBlockLineLayout.cpp:

(WebCore::constructBidiRuns):

LayoutTests:

Added a regression test.

• fast/text/empty-bdi-crash-expected.txt: Added.
• fast/text/empty-bdi-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/text/empty-bdi-crash-expected.txt (added)
• LayoutTests/fast/text/empty-bdi-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/RenderBlockLineLayout.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-11-25  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Crash in BidiRunList<Run>::replaceRunWithRuns with an empty bdi element
+        https://bugs.webkit.org/show_bug.cgi?id=73116
+
+        Reviewed by Eric Seidel.
+
+        Added a regression test.
+
+        * fast/text/empty-bdi-crash-expected.txt: Added.
+        * fast/text/empty-bdi-crash.html: Added.
+
 2011-11-25  Yury Semikhatsky  <yurys@chromium.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-11-25  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Crash in BidiRunList<Run>::replaceRunWithRuns with an empty bdi element
+        https://bugs.webkit.org/show_bug.cgi?id=73116
+
+        Reviewed by Eric Seidel.
+
+        The assertion failure was caused because isolatedResolver is initialized with
+        null start object due to the isolated run being empty.
+
+        Fixed the failure by skipping empty isolated runs.
+
+        Test: fast/text/empty-bdi-crash.html
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::constructBidiRuns):
+
 2011-11-25  Antti Koivisto  <antti@apple.com>
 

trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp

@@ -965 +965 @@
         // currently prevents this code from moving into BidiResolver.
         RenderObject* startObj = bidiFirstSkippingEmptyInlines(isolatedSpan, &isolatedResolver);
+        if (!startObj)
+            continue;
         isolatedResolver.setPosition(InlineIterator(isolatedSpan, startObj, 0));