Changeset 204620 in webkit


Ignore:
Timestamp:
Aug 18, 2016 6:01:47 PM (8 years ago)
Author:
commit-queue@webkit.org
Message:

Binding NULL pointer to reference in WebCore::RenderObject
​https://bugs.webkit.org/show_bug.cgi?id=160830

Patch by Jonathan Bedard <Jonathan Bedard> on 2016-08-18
Reviewed by Myles C. Maxfield.

No new tests needed, existing functionality not changed.

Fixes a dereferenced NULL pointer bound to a reference through a minor re-factor.

  • rendering/InlineIterator.h:

(WebCore::InlineIterator::clear): Explicit clear occurs, instead of a call to moveTo.
(WebCore::InlineIterator::moveToStartOf): Swapped pointer for reference.
(WebCore::InlineIterator::moveTo): Swapped pointer for reference.
(WebCore::InlineIterator::increment): Explicitly call clear for clarity.

  • rendering/line/BreakingContext.h:

(WebCore::BreakingContext::commitLineBreakClear): Commit a line break and clear the iterator.
(WebCore::BreakingContext::commitLineBreakAtCurrentWidth): Swapped pointer for reference.
(WebCore::BreakingContext::InlineIteratorHistory::moveTo): Swapped pointer for reference.
(WebCore::BreakingContext::increment): Explicitly call clear for clarity.
(WebCore::BreakingContext::handleBR): Swapped pointer for passed reference.
(WebCore::BreakingContext::handleReplaced): Explicitly call clear for clarity.
(WebCore::tryHyphenating): Swapped pointer for passed reference.
(WebCore::BreakingContext::handleText): Replaced all render object passing with references. Note that the caller explicitly checks if m_current.renderer() exists before calling this function.
(WebCore::BreakingContext::commitAndUpdateLineBreakIfNeeded): Explicitly call clear for clarity.
(WebCore::BreakingContext::handleEndOfLine): Explicitly call clear for clarity.

Location:
trunk/Source/WebCore
Files:
3 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebCore/ChangeLog

    r204619 r204620  
     12016-08-18  Jonathan Bedard  <jbedard@apple.com>
     2
     3        Binding NULL pointer to reference in WebCore::RenderObject
     4        https://bugs.webkit.org/show_bug.cgi?id=160830
     5
     6        Reviewed by Myles C. Maxfield.
     7
     8        No new tests needed, existing functionality not changed.
     9
     10        Fixes a dereferenced NULL pointer bound to a reference through a minor re-factor.
     11
     12        * rendering/InlineIterator.h:
     13        (WebCore::InlineIterator::clear): Explicit clear occurs, instead of a call to moveTo.
     14        (WebCore::InlineIterator::moveToStartOf): Swapped pointer for reference.
     15        (WebCore::InlineIterator::moveTo): Swapped pointer for reference.
     16        (WebCore::InlineIterator::increment): Explicitly call clear for clarity.
     17        * rendering/line/BreakingContext.h:
     18        (WebCore::BreakingContext::commitLineBreakClear): Commit a line break and clear the iterator.
     19        (WebCore::BreakingContext::commitLineBreakAtCurrentWidth): Swapped pointer for reference.
     20        (WebCore::BreakingContext::InlineIteratorHistory::moveTo): Swapped pointer for reference.
     21        (WebCore::BreakingContext::increment): Explicitly call clear for clarity.
     22        (WebCore::BreakingContext::handleBR): Swapped pointer for passed reference.
     23        (WebCore::BreakingContext::handleReplaced): Explicitly call clear for clarity.
     24        (WebCore::tryHyphenating): Swapped pointer for passed reference.
     25        (WebCore::BreakingContext::handleText): Replaced all render object passing with references.  Note that the caller explicitly checks if m_current.renderer() exists before calling this function.
     26        (WebCore::BreakingContext::commitAndUpdateLineBreakIfNeeded): Explicitly call clear for clarity.
     27        (WebCore::BreakingContext::handleEndOfLine): Explicitly call clear for clarity.
     28
    1292016-08-18  Ryosuke Niwa  <rniwa@webkit.org>
    230

  • trunk/Source/WebCore/rendering/InlineIterator.h

    r204531 r204620  
    6565    }
    6666
    67     void clear() { moveTo(nullptr, 0); }
    68 
    69     void moveToStartOf(RenderObject* object)
     67    void clear()
     68    {
     69        setRenderer(nullptr);
     70        setOffset(0);
     71        setNextBreakablePosition(-1);
     72    }
     73    void moveToStartOf(RenderObject& object)
    7074    {
    7175        moveTo(object, 0);
    7276    }
    7377
    74     void moveTo(RenderObject* object, unsigned offset, Optional<unsigned> nextBreak = Nullopt)
    75     {
    76         setRenderer(object);
     78    void moveTo(RenderObject& object, unsigned offset, Optional<unsigned> nextBreak = Optional<unsigned>())
     79    {
     80        setRenderer(&object);
    7781        setOffset(offset);
    7882        setNextBreakablePosition(nextBreak);
    … …  
    398402            return;
    399403    }
    400     // bidiNext can return nullptr, so use moveTo instead of moveToStartOf
    401     moveTo(bidiNextSkippingEmptyInlines(*m_root, m_renderer, resolver), 0);
     404    // bidiNext can return nullptr
     405    RenderObject* bidiNext = bidiNextSkippingEmptyInlines(*m_root, m_renderer, resolver);
     406    if (bidiNext)
     407        moveToStartOf(*bidiNext);
     408    else
     409        clear();
    402410}
    403411

  • trunk/Source/WebCore/rendering/line/BreakingContext.h

    r204531 r204620  
    167167    }
    168168
    169     void commitLineBreakAtCurrentWidth(RenderObject& object, unsigned offset = 0, Optional<unsigned> nextBreak = Nullopt)
     169    void commitLineBreakClear()
    170170    {
    171171        m_width.commit();
    172         m_lineBreakHistory.moveTo(&object, offset, nextBreak);
     172        m_lineBreakHistory.clear();
     173        m_hangsAtEnd = false;
     174    }
     175
     176    void commitLineBreakAtCurrentWidth(RenderObject& object, unsigned offset = 0, Optional<unsigned> nextBreak = Optional<unsigned>())
     177    {
     178        m_width.commit();
     179        m_lineBreakHistory.moveTo(object, offset, nextBreak);
    173180        m_hangsAtEnd = false;
    174181    }
    … …  
    211218        size_t historyLength() const { return this->size(); }
    212219
    213         void moveTo(RenderObject* object, unsigned offset, Optional<unsigned> nextBreak = Nullopt)
     220        void moveTo(RenderObject& object, unsigned offset, Optional<unsigned> nextBreak = Nullopt)
    214221        {
    215222            push([&](InlineIterator& modifyMe) {
    … …  
    327334        m_currentCharacterIsSpace = false;
    328335
    329     m_current.moveToStartOf(m_nextObject);
     336    if (m_nextObject)
     337        m_current.moveToStartOf(*m_nextObject);
     338    else
     339        m_current.clear();
    330340    m_atStart = false;
    331341}
    … …  
    336346        RenderObject& br = *m_current.renderer();
    337347        m_lineBreakHistory.push([&](InlineIterator& modifyMe) {
    338             modifyMe.moveToStartOf(&br);
     348            modifyMe.moveToStartOf(br);
    339349            modifyMe.increment();
    340350        });
    … …  
    534544    if (((m_autoWrap || RenderStyle::autoWrap(m_lastWS)) && (!m_current.renderer()->isImage() || m_allowImagesToBreak)
    535545        && (!m_current.renderer()->isRubyRun() || downcast<RenderRubyRun>(m_current.renderer())->canBreakBefore(m_renderTextInfo.lineBreakIterator))) || replacedBox.isAnonymousInlineBlock()) {
    536         commitLineBreakAtCurrentWidth(*m_current.renderer());
     546        if (auto* renderer = m_current.renderer())
     547            commitLineBreakAtCurrentWidth(*renderer);
     548        else
     549            commitLineBreakClear();
    537550        if (m_width.committedWidth() && replacedBox.isAnonymousInlineBlock()) {
    538551            // Always force a break before an anonymous inline block if there is content on the line
    … …  
    714727#endif
    715728
    716     lineBreak.moveTo(&text, lastSpace + prefixLength, nextBreakable);
     729    lineBreak.moveTo(text, lastSpace + prefixLength, nextBreakable);
    717730    hyphenated = true;
    718731}
    … …  
    750763        m_appliedStartWidth = false;
    751764
    752     RenderText& renderText = downcast<RenderText>(*m_current.renderer());
     765    RenderObject& renderObject = *m_current.renderer();
     766    RenderText& renderText = downcast<RenderText>(renderObject);
    753767
    754768    bool isSVGText = renderText.isSVGInlineText();
    … …  
    932946                        lineWasTooWide = true;
    933947                        m_lineBreakHistory.push([&](InlineIterator& modifyMe) {
    934                             modifyMe.moveTo(m_current.renderer(), m_current.offset(), m_current.nextBreakablePosition());
     948                            modifyMe.moveTo(renderObject, m_current.offset(), m_current.nextBreakablePosition());
    935949                            m_lineBreaker.skipTrailingWhitespace(modifyMe, m_lineInfo);
    936950                        });
    … …  
    10091023                if (!stoppedIgnoringSpaces && m_current.offset())
    10101024                    ensureCharacterGetsLineBox(m_lineWhitespaceCollapsingState, m_current);
    1011                 commitLineBreakAtCurrentWidth(*m_current.renderer(), m_current.offset(), m_current.nextBreakablePosition());
     1025                commitLineBreakAtCurrentWidth(renderObject, m_current.offset(), m_current.nextBreakablePosition());
    10121026                m_lineBreakHistory.increment();
    10131027                m_lineInfo.setPreviousLineBrokeCleanly(true);
    … …  
    10161030
    10171031            if (m_autoWrap && betweenWords) {
    1018                 commitLineBreakAtCurrentWidth(*m_current.renderer(), m_current.offset(), m_current.nextBreakablePosition());
     1032                commitLineBreakAtCurrentWidth(renderObject, m_current.offset(), m_current.nextBreakablePosition());
    10191033                wrapW = 0;
    10201034                // Auto-wrapping text should not wrap in the middle of a word once it has had an
    … …  
    10261040                // Remember this as a breakable position in case
    10271041                // adding the end width forces a break.
    1028                 m_lineBreakHistory.moveTo(m_current.renderer(), m_current.offset(), m_current.nextBreakablePosition());
     1042                m_lineBreakHistory.moveTo(renderObject, m_current.offset(), m_current.nextBreakablePosition());
    10291043                midWordBreak &= (breakWords || breakAll);
    10301044            }
    … …  
    10861100        if (!m_currentCharacterIsWS && previousCharacterIsWS) {
    10871101            if (m_autoWrap && m_currentStyle->breakOnlyAfterWhiteSpace())
    1088                 m_lineBreakHistory.moveTo(m_current.renderer(), m_current.offset(), m_current.nextBreakablePosition());
     1102                m_lineBreakHistory.moveTo(renderObject, m_current.offset(), m_current.nextBreakablePosition());
    10891103        }
    10901104
    … …  
    12241238    if (!m_current.renderer()->isFloatingOrOutOfFlowPositioned()) {
    12251239        m_lastObject = m_current.renderer();
    1226         if (m_lastObject->isReplaced() && m_autoWrap && !m_lastObject->isRubyRun() && (!m_lastObject->isImage() || m_allowImagesToBreak) && (!is<RenderListMarker>(*m_lastObject) || downcast<RenderListMarker>(*m_lastObject).isInside()))
    1227             commitLineBreakAtCurrentWidth(*m_nextObject);
     1240        if (m_lastObject->isReplaced() && m_autoWrap && !m_lastObject->isRubyRun() && (!m_lastObject->isImage() || m_allowImagesToBreak) && (!is<RenderListMarker>(*m_lastObject) || downcast<RenderListMarker>(*m_lastObject).isInside())) {
     1241            if (m_nextObject)
     1242                commitLineBreakAtCurrentWidth(*m_nextObject);
     1243            else
     1244                commitLineBreakClear();
     1245        }
    12281246    }
    12291247}
    … …  
    12581276        if (!m_lineBreakHistory.renderer() || !m_lineBreakHistory.renderer()->isBR()) {
    12591277            // we just add as much as possible
    1260             if (m_blockStyle.whiteSpace() == PRE && !m_current.offset())
    1261                 commitLineBreakAtCurrentWidth(*m_lastObject, m_lastObject->isText() ? m_lastObject->length() : 0);
     1278            if (m_blockStyle.whiteSpace() == PRE && !m_current.offset()) {
     1279                if (m_lastObject)
     1280                    commitLineBreakAtCurrentWidth(*m_lastObject, m_lastObject->isText() ? m_lastObject->length() : 0);
     1281                else
     1282                    commitLineBreakClear();
     1283            }
    12621284            else if (m_lineBreakHistory.renderer()) {
    12631285                // Don't ever break in the middle of a word if we can help it.
Note: See TracChangeset for help on using the changeset viewer.