Changeset 235485 in webkit

Timestamp:

Aug 29, 2018, 4:35:30 PM (8 years ago)

Author:

dbates@webkit.org

Message:

REGRESSION (r226138): WebCore::subdivide() may return an empty vector; Web process can crash when performing find in Epiphany
​https://bugs.webkit.org/show_bug.cgi?id=184390
<rdar://problem/41804994>
And
<rdar://problem/39771867>

Reviewed by Simon Fraser.

Source/WebCore:

Speculative fix for Epiphany.

In theory, WebCore::subdivide() should never return an empty vector - no subdivisions - as such a
result represents a programmer error. In practice, InlineTextBox can invoke WebCore::subdivide()
such that it returns an empty vector. One way this can happen is when subdividing an empty inline
text box associated with combined text (RenderCombineText). For now we add a check to bail out of
resolving the style of subdivisions when WebCore::subdivide() returns no subdivisions. In a
subsequent patch we will look to assert that WebCore::subdivide() always returns subdivisions.

Test: fast/text/text-combine-surroundContents-crash.html

• rendering/InlineTextBox.cpp:

(WebCore::InlineTextBox::subdivideAndResolveStyle):

LayoutTests:

Add a test to ensure that we do not crash when painting an empty inline text box associated
with combined text.

• fast/text/text-combine-surroundContents-crash-expected.txt: Added.
• fast/text/text-combine-surroundContents-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/text/text-combine-surroundContents-crash-expected.txt (added)
• LayoutTests/fast/text/text-combine-surroundContents-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/InlineTextBox.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2018-08-29  Daniel Bates  <dabates@apple.com>
+
+        REGRESSION (r226138): WebCore::subdivide() may return an empty vector; Web process can crash when performing find in Epiphany
+        https://bugs.webkit.org/show_bug.cgi?id=184390
+        <rdar://problem/41804994>
+        And
+        <rdar://problem/39771867>
+
+        Reviewed by Simon Fraser.
+
+        Add a test to ensure that we do not crash when painting an empty inline text box associated
+        with combined text.
+
+        * fast/text/text-combine-surroundContents-crash-expected.txt: Added.
+        * fast/text/text-combine-surroundContents-crash.html: Added.
+
 2018-08-29  Youenn Fablet  <youenn@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2018-08-29  Daniel Bates  <dabates@apple.com>
+
+        REGRESSION (r226138): WebCore::subdivide() may return an empty vector; Web process can crash when performing find in Epiphany
+        https://bugs.webkit.org/show_bug.cgi?id=184390
+        <rdar://problem/41804994>
+        And
+        <rdar://problem/39771867>
+
+        Reviewed by Simon Fraser.
+
+        Speculative fix for Epiphany.
+
+        In theory, WebCore::subdivide() should never return an empty vector - no subdivisions - as such a
+        result represents a programmer error. In practice, InlineTextBox can invoke WebCore::subdivide()
+        such that it returns an empty vector. One way this can happen is when subdividing an empty inline
+        text box associated with combined text (RenderCombineText). For now we add a check to bail out of
+        resolving the style of subdivisions when WebCore::subdivide() returns no subdivisions. In a
+        subsequent patch we will look to assert that WebCore::subdivide() always returns subdivisions.
+
+        Test: fast/text/text-combine-surroundContents-crash.html
+
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::subdivideAndResolveStyle):
+
 2018-08-29  Youenn Fablet  <youenn@apple.com>
 

trunk/Source/WebCore/rendering/InlineTextBox.cpp

@@ -793 +793 @@
 
     auto markedTexts = subdivide(textsToSubdivide);
+    if (markedTexts.isEmpty())
+        return { };
 
     // Compute frontmost overlapping styled marked texts.