Changeset 89831 in webkit

Timestamp:

Jun 27, 2011, 10:21:39 AM (15 years ago)

Author:

rniwa@webkit.org

Message:

2011-06-27 Ryosuke Niwa <​rniwa@webkit.org>

Reviewed by Kent Tamura.

Crash in TextIterator
​https://bugs.webkit.org/show_bug.cgi?id=63334

Fix a crash in TextIterator. Keep m_sortedTextBoxes and renderer consistent
and check !m_offset when handling first letter.

Also add more assertions to help detecting similar bugs.

Test: editing/text-iterator/first-letter-rtl-crash.html

• editing/TextIterator.cpp: (WebCore::TextIterator::handleTextNode): (WebCore::TextIterator::emitText):

2011-06-27 Ryosuke Niwa <​rniwa@webkit.org>

Reviewed by Kent Tamura.

Crash in TextIterator
​https://bugs.webkit.org/show_bug.cgi?id=63334

Added a test to ensure WebKit does not crash when iterating through letters in a RTL block
with first-letter rule applied where letters are not contiguous.

• editing/text-iterator/first-letter-rtl-crash-expected.txt: Added.
• editing/text-iterator/first-letter-rtl-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/editing/text-iterator/first-letter-rtl-crash-expected.txt (added)
• LayoutTests/editing/text-iterator/first-letter-rtl-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/editing/TextIterator.cpp (modified) (4 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-06-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Kent Tamura.
+
+        Crash in TextIterator
+        https://bugs.webkit.org/show_bug.cgi?id=63334
+
+        Added a test to ensure WebKit does not crash when iterating through letters in a RTL block
+        with first-letter rule applied where letters are not contiguous.
+
+        * editing/text-iterator/first-letter-rtl-crash-expected.txt: Added.
+        * editing/text-iterator/first-letter-rtl-crash.html: Added.
+
 2011-06-27  Balazs Kelemen  <kbalazs@webkit.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-06-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Kent Tamura.
+
+        Crash in TextIterator
+        https://bugs.webkit.org/show_bug.cgi?id=63334
+
+        Fix a crash in TextIterator. Keep m_sortedTextBoxes and renderer consistent
+        and check !m_offset when handling first letter.
+
+        Also add more assertions to help detecting similar bugs.
+
+        Test: editing/text-iterator/first-letter-rtl-crash.html
+
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::handleTextNode):
+        (WebCore::TextIterator::emitText):
+
 2011-06-27  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
 

trunk/Source/WebCore/editing/TextIterator.cpp

@@ -460 +460 @@
             return false;
         }
-        if (!m_handledFirstLetter && renderer->isTextFragment()) {
+        if (!m_handledFirstLetter && renderer->isTextFragment() && !m_offset) {
             handleTextNodeFirstLetter(static_cast<RenderTextFragment*>(renderer));
             if (m_firstLetterText) {
@@ -497 +497 @@
     }
 
+    
+    m_textBox = renderer->firstTextBox();
+    if (!m_handledFirstLetter && renderer->isTextFragment() && !m_offset)
+        handleTextNodeFirstLetter(static_cast<RenderTextFragment*>(renderer));
+
+    if (m_firstLetterText)
+        renderer = m_firstLetterText;
+
     // Used when text boxes are out of order (Hebrew/Arabic w/ embeded LTR text)
     if (renderer->containsReversedText()) {
@@ -505 +513 @@
         std::sort(m_sortedTextBoxes.begin(), m_sortedTextBoxes.end(), InlineTextBox::compareByStart); 
         m_sortedTextBoxesPosition = 0;
-    }
-    
-    m_textBox = renderer->containsReversedText() ? (m_sortedTextBoxes.isEmpty() ? 0 : m_sortedTextBoxes[0]) : renderer->firstTextBox();
-    if (!m_handledFirstLetter && renderer->isTextFragment() && !m_offset)
-        handleTextNodeFirstLetter(static_cast<RenderTextFragment*>(renderer));
+        m_textBox = m_sortedTextBoxes.isEmpty() ? 0 : m_sortedTextBoxes[0];
+    }
+
     handleTextBox();
     return true;
@@ -976 +982 @@
     m_text = m_emitsTextWithoutTranscoding ? renderer->textWithoutTranscoding() : renderer->text();
     ASSERT(m_text.characters());
+    ASSERT(0 <= textStartOffset && textStartOffset < static_cast<int>(m_text.length()));
+    ASSERT(0 <= textEndOffset && textEndOffset <= static_cast<int>(m_text.length()));
+    ASSERT(textStartOffset <= textEndOffset);
 
     m_positionNode = textNode;