Changeset 110640 in webkit

Timestamp:

Mar 13, 2012, 4:45:53 PM (15 years ago)

Author:

commit-queue@webkit.org

Message:

MathML crash in WebCore::Node::previousSibling()
​https://bugs.webkit.org/show_bug.cgi?id=80773

Patch by Jacky Jiang <​zhajiang@rim.com> on 2012-03-13
Reviewed by Julien Chaffraix.

Source/WebCore:

When adding child for msub render, if the child is mtr or mtd render,
we will creat an anonymous render as the container. As the anonymous
render's node is 0, accessing it directly can cause crash.
We should do a valid check of the node before using. In addition to
that, for msub, attach the anonymous render and it's children to render
tree. For msubsup, such kind of situation should never happen based on
the current codebase.

Test: mathml/msub-anonymous-child-render-crash.html

• rendering/mathml/RenderMathMLSubSup.cpp:

(WebCore::RenderMathMLSubSup::addChild):

LayoutTests:

• mathml/msub-anonymous-child-render-crash-expected.txt: Added.
• mathml/msub-anonymous-child-render-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/mathml/msub-anonymous-child-render-crash-expected.txt (added)
• LayoutTests/mathml/msub-anonymous-child-render-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2012-03-13  Jacky Jiang  <zhajiang@rim.com>
+
+        MathML crash in WebCore::Node::previousSibling()
+        https://bugs.webkit.org/show_bug.cgi?id=80773
+
+        Reviewed by Julien Chaffraix.
+
+        * mathml/msub-anonymous-child-render-crash-expected.txt: Added.
+        * mathml/msub-anonymous-child-render-crash.html: Added.
+
 2012-03-13  Mihnea Ovidenie  <mihnea@adobe.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2012-03-13  Jacky Jiang  <zhajiang@rim.com>
+
+        MathML crash in WebCore::Node::previousSibling()
+        https://bugs.webkit.org/show_bug.cgi?id=80773
+
+        Reviewed by Julien Chaffraix.
+
+        When adding child for msub render, if the child is mtr or mtd render,
+        we will creat an anonymous render as the container. As the anonymous
+        render's node is 0, accessing it directly can cause crash.
+        We should do a valid check of the node before using. In addition to
+        that, for msub, attach the anonymous render and it's children to render
+        tree. For msubsup, such kind of situation should never happen based on
+        the current codebase.
+
+        Test: mathml/msub-anonymous-child-render-crash.html
+
+        * rendering/mathml/RenderMathMLSubSup.cpp:
+        (WebCore::RenderMathMLSubSup::addChild):
+
 2012-03-13  Mihnea Ovidenie  <mihnea@adobe.com>
 

trunk/Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp

@@ -69 +69 @@
     Element* childElement = toElement(child->node());
 
-    if (!childElement->previousElementSibling()) {
+    if (childElement && !childElement->previousElementSibling()) {
         // Position 1 is always the base of the msub/msup/msubsup.
         RenderMathMLBlock* wrapper = new (renderArena()) RenderMathMLBlock(node());
@@ -96 +96 @@
     } else {
         if (m_kind == SubSup) {
+            ASSERT(childElement);
+            if (!childElement)
+                return;
+
             RenderBlock* script = new (renderArena()) RenderMathMLBlock(node());
             RefPtr<RenderStyle> scriptStyle = RenderStyle::create();