Changeset 107733 in webkit

Timestamp:

Feb 14, 2012 2:02:05 PM (12 years ago)

Author:

commit-queue@webkit.org

Message:

Crash from line break iterators in counter content
​https://bugs.webkit.org/show_bug.cgi?id=72977

Patch by Ken Buchanan <​kenrb@chromium.org> on 2012-02-14
Reviewed by David Hyatt.

Source/WebCore:

Calculating the width of counter text can sometimes cause the
underlying text buffer to change. This patch causes the iterator
to reset appropriately when this happens.

• rendering/RenderBlockLineLayout.cpp:

(WebCore::RenderBlock::LineBreaker::nextLineBreak):

LayoutTests:

Test that causes asterisk counters to change during layout
and potentially confuse iterators.

• fast/css/counters/asterisk-counter-update-after-layout-crash-expected.txt: Added
• fast/css/counters/asterisk-counter-update-after-layout-crash.html: Added

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/css/counters/asterisk-counter-update-after-layout-crash-expected.txt (added)
• LayoutTests/fast/css/counters/asterisk-counter-update-after-layout-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/RenderBlockLineLayout.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2012-02-14  Ken Buchanan  <kenrb@chromium.org>
+
+        Crash from line break iterators in counter content
+        https://bugs.webkit.org/show_bug.cgi?id=72977
+
+        Reviewed by David Hyatt.
+
+        Test that causes asterisk counters to change during layout
+        and potentially confuse iterators.
+
+        * fast/css/counters/asterisk-counter-update-after-layout-crash-expected.txt: Added
+        * fast/css/counters/asterisk-counter-update-after-layout-crash.html: Added
+
 2012-02-14  Filip Pizlo  <fpizlo@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2012-02-14  Ken Buchanan  <kenrb@chromium.org>
+
+        Crash from line break iterators in counter content
+        https://bugs.webkit.org/show_bug.cgi?id=72977
+
+        Reviewed by David Hyatt.
+
+        Calculating the width of counter text can sometimes cause the
+        underlying text buffer to change. This patch causes the iterator
+        to reset appropriately when this happens.
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::LineBreaker::nextLineBreak):
+
 2012-02-14  Levi Weintraub  <leviw@chromium.org>
 

trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp

@@ -2355 +2355 @@
                 }
 
-                if (lineBreakIteratorInfo.first != t) {
+                if ((lineBreakIteratorInfo.first != t) || (lineBreakIteratorInfo.second.string() != t->characters())) {
                     lineBreakIteratorInfo.first = t;
                     lineBreakIteratorInfo.second.reset(t->characters(), t->textLength(), style->locale());