Changeset 147087 in webkit

Timestamp:

Mar 28, 2013 2:13:21 AM (11 years ago)

Author:

commit-queue@webkit.org

Message:

Regression: Crash when selecting Hebrew and numbers in a list
​https://bugs.webkit.org/show_bug.cgi?id=111894

Patch by Arpita Bahuguna <​a.bah@samsung.com> on 2013-03-28
Reviewed by Ryosuke Niwa.

Source/WebCore:

There is a crash when trying to click/select an anonymous
renderer.

This is a regression due to r143313 which tries to add border/padding
to the computed caret rect in RenderBox::localCaretRect().
The patch calls on the node() method for the corresponding
renderer. For an anonymous renderer though, node() returns
null. Since no check had been added for this, a crash occurs when
caret rect for an anonymous renderer is being computed.

Test: editing/selection/click-on-anonymous-content-crash.html

• rendering/RenderBox.cpp:

(WebCore::RenderBox::localCaretRect):
Added a check for validating the return from the node() call.

LayoutTests:

• editing/selection/click-on-anonymous-content-crash-expected.txt: Added.
• editing/selection/click-on-anonymous-content-crash.html: Added.

Added a testcase for verifying that no crash occurs when trying to
select/click an anonymous renderer, in this case the list marker's
renderer.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/editing/selection/click-on-anonymous-content-crash-expected.txt (added)
• LayoutTests/editing/selection/click-on-anonymous-content-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/RenderBox.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2013-03-28  Arpita Bahuguna  <a.bah@samsung.com>
+
+        Regression: Crash when selecting Hebrew and numbers in a list
+        https://bugs.webkit.org/show_bug.cgi?id=111894
+
+        Reviewed by Ryosuke Niwa.
+
+        * editing/selection/click-on-anonymous-content-crash-expected.txt: Added.
+        * editing/selection/click-on-anonymous-content-crash.html: Added.
+        Added a testcase for verifying that no crash occurs when trying to
+        select/click an anonymous renderer, in this case the list marker's
+        renderer.
+
 2013-03-28  Mike West  <mkwst@chromium.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2013-03-28  Arpita Bahuguna  <a.bah@samsung.com>
+
+        Regression: Crash when selecting Hebrew and numbers in a list
+        https://bugs.webkit.org/show_bug.cgi?id=111894
+
+        Reviewed by Ryosuke Niwa.
+
+        There is a crash when trying to click/select an anonymous
+        renderer.
+
+        This is a regression due to r143313 which tries to add border/padding
+        to the computed caret rect in RenderBox::localCaretRect().
+        The patch calls on the node() method for the corresponding
+        renderer. For an anonymous renderer though, node() returns
+        null. Since no check had been added for this, a crash occurs when
+        caret rect for an anonymous renderer is being computed.
+
+        Test: editing/selection/click-on-anonymous-content-crash.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::localCaretRect):
+        Added a check for validating the return from the node() call.
+
 2013-03-28  Mike West  <mkwst@chromium.org>
 

trunk/Source/WebCore/rendering/RenderBox.cpp

@@ -3993 +3993 @@
     // is needed because we use offsets inside an "atomic" element to represent
     // positions before and after the element in deprecated editing offsets.
-    if (!(editingIgnoresContent(node()) || isTableElement(node()))) {
+    if (node() && !(editingIgnoresContent(node()) || isTableElement(node()))) {
         rect.setX(rect.x() + borderLeft() + paddingLeft());
         rect.setY(rect.y() + paddingTop() + borderTop());