Changeset 287771 in webkit

Timestamp:

Jan 7, 2022, 11:34:59 AM (5 years ago)

Author:

commit-queue@webkit.org

Message:

nullptr deref in ComputeFloatOffsetForLineLayoutAdapter<FloatingObject::FloatLeft>::updateOffsetIfNeeded
​https://bugs.webkit.org/show_bug.cgi?id=234018

Patch by Gabriel Nava Marino <​gnavamarino@apple.com> on 2022-01-07
Reviewed by Darin Adler.

In RenderBlockFlow::subtreeContainsFloat and RenderBlockFlow::subtreeContainsFloats we now will
use a non-recursive iterator and return true when we find something, or then return false at the
end of the function.

• rendering/RenderBlockFlow.cpp:

(WebCore::RenderBlockFlow::subtreeContainsFloat const):
(WebCore::RenderBlockFlow::subtreeContainsFloats const):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• rendering/RenderBlockFlow.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2022-01-07  Gabriel Nava Marino  <gnavamarino@apple.com>
+
+        nullptr deref in ComputeFloatOffsetForLineLayoutAdapter<FloatingObject::FloatLeft>::updateOffsetIfNeeded
+        https://bugs.webkit.org/show_bug.cgi?id=234018
+
+        Reviewed by Darin Adler.
+
+        In RenderBlockFlow::subtreeContainsFloat and RenderBlockFlow::subtreeContainsFloats we now will
+        use a non-recursive iterator and return true when we find something, or then return false at the
+        end of the function.
+
+        * rendering/RenderBlockFlow.cpp:
+        (WebCore::RenderBlockFlow::subtreeContainsFloat const):
+        (WebCore::RenderBlockFlow::subtreeContainsFloats const):
+
 2022-01-07  Alex Christensen  <achristensen@webkit.org>
 

trunk/Source/WebCore/rendering/RenderBlockFlow.cpp

@@ -1952 +1952 @@
 bool RenderBlockFlow::subtreeContainsFloat(RenderBox& renderer) const
 {
-    bool contains = m_floatingObjects && m_floatingObjects->set().contains<FloatingObjectHashTranslator>(renderer);
-    for (auto& block : childrenOfType<RenderBlock>(*this)) {
+    if (containsFloat(renderer))
+        return true;
+
+    for (auto& block : descendantsOfType<RenderBlock>(const_cast<RenderBlockFlow&>(*this))) {
         if (!is<RenderBlockFlow>(block))
             continue;
         auto& blockFlow = downcast<RenderBlockFlow>(block);
-        contains |= blockFlow.subtreeContainsFloat(renderer);
-    }
-    return contains;
+        if (blockFlow.containsFloat(renderer))
+            return true;
+    }
+
+    return false;
 }
 
 bool RenderBlockFlow::subtreeContainsFloats() const
 {
-    bool contains = m_floatingObjects && !m_floatingObjects->set().isEmpty();
-    for (auto& block : childrenOfType<RenderBlock>(*this)) {
+    if (containsFloats())
+        return true;
+
+    for (auto& block : descendantsOfType<RenderBlock>(const_cast<RenderBlockFlow&>(*this))) {
         if (!is<RenderBlockFlow>(block))
             continue;
         auto& blockFlow = downcast<RenderBlockFlow>(block);
-        contains |= blockFlow.subtreeContainsFloats();
-    }
-    return contains;
+        if (blockFlow.containsFloats())
+            return true;
+    }
+
+    return false;
 }