Changeset 199113 in webkit

Timestamp:

Apr 6, 2016 1:03:58 PM (8 years ago)

Author:

Alan Bujtas

Message:

Add ASSERT_WITH_SECURITY_IMPLICATION when a float box is referenced by multiple RootInlineBoxes.
​https://bugs.webkit.org/show_bug.cgi?id=156297
<rdar://problem/25580844>

Reviewed by Brent Fulgham.

See ​http://trac.webkit.org/changeset/199101

No change in functionality.

• rendering/RenderBlockLineLayout.cpp:

(WebCore::RenderBlockFlow::appendFloatingObjectToLastLine):
(WebCore::RenderBlockFlow::reattachCleanLineFloats):
(WebCore::RenderBlockFlow::determineStartPosition):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• rendering/RenderBlockLineLayout.cpp (modified) (3 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2016-04-06  Zalan Bujtas  <zalan@apple.com>
+
+        Add ASSERT_WITH_SECURITY_IMPLICATION when a float box is referenced by multiple RootInlineBoxes.
+        https://bugs.webkit.org/show_bug.cgi?id=156297
+        <rdar://problem/25580844>
+
+        Reviewed by Brent Fulgham.
+
+        See http://trac.webkit.org/changeset/199101
+
+        No change in functionality.
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlockFlow::appendFloatingObjectToLastLine):
+        (WebCore::RenderBlockFlow::reattachCleanLineFloats):
+        (WebCore::RenderBlockFlow::determineStartPosition):
+
 2016-04-06  Sam Weinig  <sam@webkit.org>
 

trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp

@@ -1061 +1061 @@
 void RenderBlockFlow::appendFloatingObjectToLastLine(FloatingObject* floatingObject)
 {
-    ASSERT(!floatingObject->originatingLine());
+    ASSERT_WITH_SECURITY_IMPLICATION(!floatingObject->originatingLine());
     floatingObject->setOriginatingLine(lastRootBox());
     lastRootBox()->appendFloat(floatingObject->renderer());
@@ -1532 +1532 @@
         if (isFirstCleanLine && floatingObject->originatingLine()) {
             // Float box does not belong to this line anymore.
-            ASSERT(cleanLine.prevRootBox() == floatingObject->originatingLine());
+            ASSERT_WITH_SECURITY_IMPLICATION(cleanLine.prevRootBox() == floatingObject->originatingLine());
             cleanLine.removeFloat(*floatingBox);
             continue;
         }
-        ASSERT(!floatingObject->originatingLine());
+        ASSERT_WITH_SECURITY_IMPLICATION(!floatingObject->originatingLine());
         floatingObject->setOriginatingLine(&cleanLine);
         setLogicalHeight(logicalTopForChild(*floatingBox) - marginBeforeForChild(*floatingBox) + delta);
@@ -1860 +1860 @@
                     RenderBox* floatingBox = *it;
                     FloatingObject* floatingObject = insertFloatingObject(*floatingBox);
-                    ASSERT(!floatingObject->originatingLine());
+                    ASSERT_WITH_SECURITY_IMPLICATION(!floatingObject->originatingLine());
                     floatingObject->setOriginatingLine(line);
                     setLogicalHeight(logicalTopForChild(*floatingBox) - marginBeforeForChild(*floatingBox));