Changeset 161137 in webkit

Timestamp:

Dec 29, 2013 10:31:41 PM (10 years ago)

Author:

joone.hur@intel.com

Message:

Reverted r156742. The same fix was reverted from Blink due to heap-use-after-free on ClusterFuzz.
​https://bugs.webkit.org/show_bug.cgi?id=126275

​https://codereview.chromium.org/102993011

Reviewed by Darin Adler.

Source/WebCore:

• rendering/RenderBlock.cpp:

(WebCore::RenderBlock::updateFirstLetter):

LayoutTests:

• fast/css/first-letter-block-change.html: Removed.
• platform/gtk-wk1/fast/css/first-letter-block-change-expected.png: Removed.
• platform/gtk-wk2/fast/css/first-letter-block-change-expected.png: Removed.
• platform/gtk/fast/css/first-letter-block-change-expected.txt: Removed.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/css/first-letter-block-change.html (deleted)
• LayoutTests/platform/gtk-wk1/fast/css/first-letter-block-change-expected.png (deleted)
• LayoutTests/platform/gtk-wk2/fast/css (deleted)
• LayoutTests/platform/gtk/fast/css/first-letter-block-change-expected.txt (deleted)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/RenderBlock.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2013-12-29  Joone Hur  <joone.hur@intel.com>
+
+        Reverted r156742. The same fix was reverted from Blink due to heap-use-after-free on ClusterFuzz.
+        https://bugs.webkit.org/show_bug.cgi?id=126275
+
+        https://codereview.chromium.org/102993011
+
+        Reviewed by Darin Adler.
+
+        * fast/css/first-letter-block-change.html: Removed.
+        * platform/gtk-wk1/fast/css/first-letter-block-change-expected.png: Removed.
+        * platform/gtk-wk2/fast/css/first-letter-block-change-expected.png: Removed.
+        * platform/gtk/fast/css/first-letter-block-change-expected.txt: Removed.
+
 2013-12-29  Antti Koivisto  <antti@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2013-12-29  Joone Hur  <joone.hur@intel.com>
+
+        Reverted r156742. The same fix was reverted from Blink due to heap-use-after-free on ClusterFuzz.
+        https://bugs.webkit.org/show_bug.cgi?id=126275
+
+        https://codereview.chromium.org/102993011
+
+        Reviewed by Darin Adler.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateFirstLetter):
+
 2013-12-29  ChangSeok Oh  <changseok.oh@collabora.com>
 

trunk/Source/WebCore/rendering/RenderBlock.cpp

@@ -4990 +4990 @@
         return;
 
+    // FIXME: We need to destroy the first-letter object if it is no longer the first child. Need to find
+    // an efficient way to check for that situation though before implementing anything.
     RenderElement* firstLetterBlock = findFirstLetterBlock(this);
     if (!firstLetterBlock)
@@ -5021 +5023 @@
         return;
 
+    // If the child already has style, then it has already been created, so we just want
+    // to update it.
     if (descendant->parent()->style().styleType() == FIRST_LETTER) {
-        // Destroy the first-letter object if it is no longer the first child.
-        RenderObject* remainingText = descendant->parent()->nextSibling();
-        if (remainingText && descendant->node() != remainingText->node()) {
-            if (!remainingText->isText() || remainingText->isBR())
-                return;
-
-            if (auto oldFirstLetter = descendant->parent()->isBoxModelObject() ?  toRenderBoxModelObject(descendant->parent()) : nullptr) { 
-                if (auto oldRemainingText = oldFirstLetter->firstLetterRemainingText()) {
-                    LayoutStateDisabler layoutStateDisabler(&view());
-                    // Destroy the text fragment for the old first-letter and update oldRemainingText with its DOM text.
-                    oldRemainingText->setText(oldRemainingText->textNode()->data());
-                    createFirstLetterRenderer(firstLetterBlock, toRenderText(remainingText));
-                }    
-            }    
-
-            return;
-        }    
-
-        // If the child already has style, then it has already been created, so we just want
-        // to update it.
         updateFirstLetterStyle(firstLetterBlock, descendant);
         return;