Changeset 121921 in webkit

Timestamp:

Jul 5, 2012 1:03:40 PM (12 years ago)

Author:

leandrogracia@chromium.org

Message:

Character iterators should not advance if they are at end
​https://bugs.webkit.org/show_bug.cgi?id=90560

Reviewed by Ryosuke Niwa.

Source/WebCore:

CharacterIterator and BackwardsCharacterIterator try to advance their
internal TextIterator without checking if they already are at end.
This can cause crashes in TextIterator::advance.

Test: platform/chromium/editing/surrounding-text/surrounding-text.html

• editing/SurroundingText.cpp:

(WebCore::SurroundingText::SurroundingText):

• editing/TextIterator.cpp:

(WebCore::CharacterIterator::advance):
(WebCore::BackwardsCharacterIterator::advance):

LayoutTests:

Add a new test case where character iterators are already at end when
trying to advance. This was caught by Chromium's address sanitizer
here: ​http://code.google.com/p/chromium/issues/detail?id=135705

• platform/chromium/editing/surrounding-text/surrounding-text-expected.txt:
• platform/chromium/editing/surrounding-text/surrounding-text.html:

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/platform/chromium/editing/surrounding-text/surrounding-text-expected.txt (modified) (1 diff)
• LayoutTests/platform/chromium/editing/surrounding-text/surrounding-text.html (modified) (1 diff)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/editing/SurroundingText.cpp (modified) (2 diffs)
• Source/WebCore/editing/TextIterator.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2012-07-05  Leandro Gracia Gil  <leandrogracia@chromium.org>
+
+        Character iterators should not advance if they are at end
+        https://bugs.webkit.org/show_bug.cgi?id=90560
+
+        Reviewed by Ryosuke Niwa.
+
+        Add a new test case where character iterators are already at end when
+        trying to advance. This was caught by Chromium's address sanitizer
+        here: http://code.google.com/p/chromium/issues/detail?id=135705
+
+        * platform/chromium/editing/surrounding-text/surrounding-text-expected.txt:
+        * platform/chromium/editing/surrounding-text/surrounding-text.html:
+
 2012-07-05  Alexey Proskuryakov  <ap@apple.com>
 

trunk/LayoutTests/platform/chromium/editing/surrounding-text/surrounding-text-expected.txt

@@ -16 +16 @@
 PASS surroundingText('<option>.</option>12345<button id="here">test</button><option>.</option>', 0, 100) is ""
 PASS surroundingText('<option>.</option>12345<button>te<span id="here">st</span></button><option>.</option>', 0, 100) is ""
+PASS surroundingText('<p id="here">.', 0, 2) is "."
 PASS successfullyParsed is true
 

trunk/LayoutTests/platform/chromium/editing/surrounding-text/surrounding-text.html

@@ -41 +41 @@
     shouldBeEqualToString('surroundingText(\'<option>.</option>12345<button id="here">test</button><option>.</option>\', 0, 100)', '');
     shouldBeEqualToString('surroundingText(\'<option>.</option>12345<button>te<span id="here">st</span></button><option>.</option>\', 0, 100)', '');
+    shouldBeEqualToString('surroundingText(\'<p id="here">.\', 0, 2)', '.');
 
     document.body.removeChild(document.getElementById('test'));

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2012-07-05  Leandro Gracia Gil  <leandrogracia@chromium.org>
+
+        Character iterators should not advance if they are at end
+        https://bugs.webkit.org/show_bug.cgi?id=90560
+
+        Reviewed by Ryosuke Niwa.
+
+        CharacterIterator and BackwardsCharacterIterator try to advance their
+        internal TextIterator without checking if they already are at end.
+        This can cause crashes in TextIterator::advance.
+
+        Test: platform/chromium/editing/surrounding-text/surrounding-text.html
+
+        * editing/SurroundingText.cpp:
+        (WebCore::SurroundingText::SurroundingText):
+        * editing/TextIterator.cpp:
+        (WebCore::CharacterIterator::advance):
+        (WebCore::BackwardsCharacterIterator::advance):
+
 2012-07-05  John Mellor  <johnme@chromium.org>
 

trunk/Source/WebCore/editing/SurroundingText.cpp

@@ -46 +46 @@
     const unsigned halfMaxLength = maxLength / 2;
     CharacterIterator forwardIterator(makeRange(visiblePosition, endOfDocument(visiblePosition)).get(), TextIteratorStopsOnFormControls);
-    forwardIterator.advance(maxLength - halfMaxLength);
+    if (!forwardIterator.atEnd())
+        forwardIterator.advance(maxLength - halfMaxLength);
 
     Position position = visiblePosition.deepEquivalent().parentAnchoredEquivalent();
@@ -54 +55 @@
 
     BackwardsCharacterIterator backwardsIterator(makeRange(startOfDocument(visiblePosition), visiblePosition).get(), TextIteratorStopsOnFormControls);
-    backwardsIterator.advance(halfMaxLength);
+    if (!backwardsIterator.atEnd())
+        backwardsIterator.advance(halfMaxLength);
 
     m_positionOffsetInContent = Range::create(document, backwardsIterator.range()->endPosition(), position)->text().length();

trunk/Source/WebCore/editing/TextIterator.cpp

@@ -1407 +1407 @@
 void CharacterIterator::advance(int count)
 {
+    ASSERT(!atEnd());
+
     if (count <= 0) {
         ASSERT(count == 0);
@@ -1515 +1517 @@
 void BackwardsCharacterIterator::advance(int count)
 {
+    ASSERT(!atEnd());
+
     if (count <= 0) {
         ASSERT(!count);