Changeset 92132 in webkit

Timestamp:

Aug 1, 2011, 11:03:03 AM (15 years ago)

Author:

inferno@chromium.org

Message:

Regression(82144): Crash in TrailingObjects::updateMidpointsForTrailingBoxes
​https://bugs.webkit.org/show_bug.cgi?id=65137

Source/WebCore:

Fix the looping condition to prevent trailingSpaceMidpoint from becoming negative.

Reviewed by Dave Hyatt.

Test: fast/block/update-midpoints-for-trailing-boxes-crash.html

• rendering/RenderBlockLineLayout.cpp:

(WebCore::TrailingObjects::updateMidpointsForTrailingBoxes):

LayoutTests:

ASSERTION FAILED: trailingSpaceMidpoint >= 0

Reviewed by Dave Hyatt.

• fast/block/update-midpoints-for-trailing-boxes-crash-expected.txt: Added.
• fast/block/update-midpoints-for-trailing-boxes-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/block/update-midpoints-for-trailing-boxes-crash-expected.txt (added)
• LayoutTests/fast/block/update-midpoints-for-trailing-boxes-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/RenderBlockLineLayout.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-07-28  Abhishek Arya  <inferno@chromium.org>
+
+        Regression(82144): Crash in TrailingObjects::updateMidpointsForTrailingBoxes
+        https://bugs.webkit.org/show_bug.cgi?id=65137
+
+        ASSERTION FAILED: trailingSpaceMidpoint >= 0
+
+        Reviewed by Dave Hyatt.
+
+        * fast/block/update-midpoints-for-trailing-boxes-crash-expected.txt: Added.
+        * fast/block/update-midpoints-for-trailing-boxes-crash.html: Added.
+
 2011-08-01  Csaba Osztrogonác  <ossy@webkit.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-07-28  Abhishek Arya  <inferno@chromium.org>
+
+        Regression(82144): Crash in TrailingObjects::updateMidpointsForTrailingBoxes
+        https://bugs.webkit.org/show_bug.cgi?id=65137
+
+        Fix the looping condition to prevent trailingSpaceMidpoint from becoming negative.
+
+        Reviewed by Dave Hyatt.
+
+        Test: fast/block/update-midpoints-for-trailing-boxes-crash.html
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::TrailingObjects::updateMidpointsForTrailingBoxes):
+
 2011-08-01  Benjamin Poulain  <benjamin@webkit.org>
 

trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp

@@ -1839 +1839 @@
         // Find the trailing space object's midpoint.
         int trailingSpaceMidpoint = lineMidpointState.numMidpoints - 1;
-        for ( ; trailingSpaceMidpoint >= 0 && lineMidpointState.midpoints[trailingSpaceMidpoint].m_obj != m_whitespace; --trailingSpaceMidpoint) { }
+        for ( ; trailingSpaceMidpoint > 0 && lineMidpointState.midpoints[trailingSpaceMidpoint].m_obj != m_whitespace; --trailingSpaceMidpoint) { }
         ASSERT(trailingSpaceMidpoint >= 0);
         if (collapseFirstSpace == CollapseFirstSpace)