Changeset 176295 in webkit

Timestamp:

Nov 18, 2014, 4:37:35 PM (12 years ago)

Author:

hyatt@apple.com

Message:

REGRESSION (r167210): Invalid cast in WebCore::RenderBlock::blockSelectionGaps
​https://bugs.webkit.org/show_bug.cgi?id=137590

Reviewed by Dean Jackson.

Source/WebCore:

Added fast/block/selection-block-gaps-crash.html

• rendering/RenderBlock.cpp:

(WebCore::RenderBlock::blockSelectionGaps):
Check that we really are a RenderBlock before recurring.

LayoutTests:

• fast/block/selection-block-gap-crash-expected.txt: Added.
• fast/block/selection-block-gap-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/block/selection-block-gap-crash-expected.txt (added)
• LayoutTests/fast/block/selection-block-gap-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/RenderBlock.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2014-11-18  David Hyatt  <hyatt@apple.com>
+
+        REGRESSION (r167210): Invalid cast in WebCore::RenderBlock::blockSelectionGaps
+        https://bugs.webkit.org/show_bug.cgi?id=137590
+
+        Reviewed by Dean Jackson.
+
+        * fast/block/selection-block-gap-crash-expected.txt: Added.
+        * fast/block/selection-block-gap-crash.html: Added.
+
 2014-11-18  Andreas Kling  <akling@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2014-11-18  David Hyatt  <hyatt@apple.com>
+
+        REGRESSION (r167210): Invalid cast in WebCore::RenderBlock::blockSelectionGaps
+        https://bugs.webkit.org/show_bug.cgi?id=137590
+
+        Reviewed by Dean Jackson.
+
+        Added fast/block/selection-block-gaps-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::blockSelectionGaps):
+        Check that we really are a RenderBlock before recurring.
+
 2014-11-18  Andreas Kling  <akling@apple.com>
 

trunk/Source/WebCore/rendering/RenderBlock.cpp

@@ -1957 +1957 @@
             lastLogicalLeft = logicalLeftSelectionOffset(rootBlock, curr->logicalBottom(), cache);
             lastLogicalRight = logicalRightSelectionOffset(rootBlock, curr->logicalBottom(), cache);
-        } else if (childState != SelectionNone) {
+        } else if (childState != SelectionNone && is<RenderBlock>(*curr)) {
             // We must be a block that has some selected object inside it.  Go ahead and recur.
             result.unite(downcast<RenderBlock>(*curr).selectionGaps(rootBlock, rootBlockPhysicalPosition, LayoutSize(offsetFromRootBlock.width() + curr->x(), offsetFromRootBlock.height() + curr->y()),