Changeset 236109 in webkit

Timestamp:

Sep 18, 2018, 2:16:33 AM (8 years ago)

Author:

Carlos Garcia Campos

Message:

Merge r235416 - Null pointer deref in WidthIterator
​https://bugs.webkit.org/show_bug.cgi?id=188993

Reviewed by Brent Fulgham.

Source/WebCore:

Test: fast/text/rtl-justification.html

We simply need to guard glyphBuffer like we do in the rest of the function.

• platform/graphics/WidthIterator.cpp:

(WebCore::WidthIterator::advanceInternal):

LayoutTests:

• fast/text/rtl-justification-expected.html: Added.
• fast/text/rtl-justification.html: Added.

Location:

releases/WebKitGTK/webkit-2.22

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/text/rtl-justification-expected.html (added)
• LayoutTests/fast/text/rtl-justification.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/platform/graphics/WidthIterator.cpp (modified) (1 diff)

releases/WebKitGTK/webkit-2.22/LayoutTests/ChangeLog

@@ +1 @@
+2018-08-27  Myles C. Maxfield  <mmaxfield@apple.com>
+
+        Null pointer deref in WidthIterator
+        https://bugs.webkit.org/show_bug.cgi?id=188993
+
+        Reviewed by Brent Fulgham.
+
+        * fast/text/rtl-justification-expected.html: Added.
+        * fast/text/rtl-justification.html: Added.
+
 2018-08-27  Youenn Fablet  <youenn@apple.com>
 

releases/WebKitGTK/webkit-2.22/Source/WebCore/ChangeLog

@@ +1 @@
+2018-08-27  Myles C. Maxfield  <mmaxfield@apple.com>
+
+        Null pointer deref in WidthIterator
+        https://bugs.webkit.org/show_bug.cgi?id=188993
+
+        Reviewed by Brent Fulgham.
+
+        Test: fast/text/rtl-justification.html
+
+        We simply need to guard glyphBuffer like we do in the rest of the function.
+
+        * platform/graphics/WidthIterator.cpp:
+        (WebCore::WidthIterator::advanceInternal):
+
 2018-08-27  Youenn Fablet  <youenn@apple.com>
 

releases/WebKitGTK/webkit-2.22/Source/WebCore/platform/graphics/WidthIterator.cpp

@@ -346 +346 @@
     }
 
-    if (leftoverJustificationWidth) {
+    if (glyphBuffer && leftoverJustificationWidth) {
         if (m_forTextEmphasis)
             glyphBuffer->add(lastFontData->zeroWidthSpaceGlyph(), lastFontData, leftoverJustificationWidth, m_run.length() - 1);