Changeset 106298 in webkit

Timestamp:

Jan 30, 2012 4:18:19 PM (12 years ago)

Author:

rniwa@webkit.org

Message:

Crash in previousLinePosition when moving into a root inline box without leaves
​https://bugs.webkit.org/show_bug.cgi?id=76812

Reviewed by Enrica Casucci.

Source/WebCore:

The crash was caused by us assuming that every root inline box has at least one leaf,
which isn't true when we create inline boxes for an empty text run with margin, border, etc...

Test: editing/selection/move-into-empty-root-inline-box.html

• editing/visible_units.cpp:

(WebCore::previousLinePosition):
(WebCore::nextLinePosition):

LayoutTests:

Add a regression test for the crash. Unfortunately, we can only test previousLinePosition.

• editing/selection/move-into-empty-root-inline-box-expected.txt: Added.
• editing/selection/move-into-empty-root-inline-box.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/editing/selection/move-into-empty-root-inline-box-expected.txt (added)
• LayoutTests/editing/selection/move-into-empty-root-inline-box.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/editing/visible_units.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2012-01-30  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Crash in previousLinePosition when moving into a root inline box without leaves
+        https://bugs.webkit.org/show_bug.cgi?id=76812
+
+        Reviewed by Enrica Casucci.
+
+        Add a regression test for the crash. Unfortunately, we can only test previousLinePosition.
+
+        * editing/selection/move-into-empty-root-inline-box-expected.txt: Added.
+        * editing/selection/move-into-empty-root-inline-box.html: Added.
+
 2012-01-30  Oliver Hunt  <oliver@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2012-01-30  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Crash in previousLinePosition when moving into a root inline box without leaves
+        https://bugs.webkit.org/show_bug.cgi?id=76812
+
+        Reviewed by Enrica Casucci.
+
+        The crash was caused by us assuming that every root inline box has at least one leaf,
+        which isn't true when we create inline boxes for an empty text run with margin, border, etc...
+
+        Test: editing/selection/move-into-empty-root-inline-box.html
+
+        * editing/visible_units.cpp:
+        (WebCore::previousLinePosition):
+        (WebCore::nextLinePosition):
+
 2012-01-30  Levi Weintraub  <leviw@chromium.org>
 

trunk/Source/WebCore/editing/visible_units.cpp

@@ -577 +577 @@
         // We want to skip zero height boxes.
         // This could happen in case it is a TrailingFloatsRootInlineBox.
-        if (!root || !root->logicalHeight())
+        if (!root || !root->logicalHeight() || !root->firstLeafChild())
             root = 0;
     }
@@ -678 +678 @@
         // We want to skip zero height boxes.
         // This could happen in case it is a TrailingFloatsRootInlineBox.
-        if (!root || !root->logicalHeight())
+        if (!root || !root->logicalHeight() || !root->firstLeafChild())
             root = 0;
     }