Changeset 52184 in webkit

Timestamp:

Dec 15, 2009 6:02:12 PM (14 years ago)

Author:

rolandsteiner@chromium.org

Message:

Fix crash when encountering illegal HTML within a continuation inside <ruby>.
(​https://bugs.webkit.org/show_bug.cgi?id=32316)

Reviewed by Adam Barth.

Avoid having the anonymous blocks utilized in the ruby renderers being
re-used as continuation blocks.
Avoid having ruby runs collected as "leftover blocks".

Test: fast/ruby/ruby-illegal.html

WebCore:

• rendering/RenderRuby.h:

(WebCore::RenderRubyAsInline::removeLeftoverAnonymousBlock): mustn't be called
(WebCore::RenderRubyAsInline::isRuby): made private
(WebCore::RenderRubyAsInline::renderName): made private
(WebCore::RenderRubyAsInline::createsAnonymousWrapper): return true
(WebCore::RenderRubyAsBlock::removeLeftoverAnonymousBlock): mustn't be called
(WebCore::RenderRubyAsBlock::isRuby): made private
(WebCore::RenderRubyAsBlock::renderName): made private
(WebCore::RenderRubyAsBlock::createsAnonymousWrapper): return true

• rendering/RenderRubyRun.h:

(WebCore::RenderRubyRun::removeLeftoverAnonymousBlock): avoid
(WebCore::RenderRubyRun::isRubyRun): made private
(WebCore::RenderRubyRun::renderName): made private
(WebCore::RenderRubyRun::createsAnonymousWrapper): return true

LayoutTests:

• fast/ruby/ruby-illegal-expected.txt: Added.
• fast/ruby/ruby-illegal.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/ruby/ruby-illegal-expected.txt (added)
• LayoutTests/fast/ruby/ruby-illegal.html (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/rendering/RenderRuby.h (modified) (2 diffs)
• WebCore/rendering/RenderRubyRun.h (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2009-12-13  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix crash when encountering illegal HTML within a continuation inside <ruby>.
+        (https://bugs.webkit.org/show_bug.cgi?id=32316)
+
+        Avoid having the anonymous blocks utilized in the ruby renderers being
+        re-used as continuation blocks.
+        Avoid having ruby runs collected as "leftover blocks".
+
+        * fast/ruby/ruby-illegal-expected.txt: Added.
+        * fast/ruby/ruby-illegal.html: Added.
+
 2009-12-15  Dan Bernstein  <mitz@apple.com>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2009-12-13  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix crash when encountering illegal HTML within a continuation inside <ruby>.
+        (https://bugs.webkit.org/show_bug.cgi?id=32316)
+
+        Avoid having the anonymous blocks utilized in the ruby renderers being
+        re-used as continuation blocks.
+        Avoid having ruby runs collected as "leftover blocks".
+
+        Test: fast/ruby/ruby-illegal.html
+
+        * rendering/RenderRuby.h:
+        (WebCore::RenderRubyAsInline::removeLeftoverAnonymousBlock): mustn't be called
+        (WebCore::RenderRubyAsInline::isRuby): made private
+        (WebCore::RenderRubyAsInline::renderName): made private
+        (WebCore::RenderRubyAsInline::createsAnonymousWrapper): return true
+        (WebCore::RenderRubyAsBlock::removeLeftoverAnonymousBlock): mustn't be called
+        (WebCore::RenderRubyAsBlock::isRuby): made private
+        (WebCore::RenderRubyAsBlock::renderName): made private
+        (WebCore::RenderRubyAsBlock::createsAnonymousWrapper): return true
+        * rendering/RenderRubyRun.h:
+        (WebCore::RenderRubyRun::removeLeftoverAnonymousBlock): avoid
+        (WebCore::RenderRubyRun::isRubyRun): made private
+        (WebCore::RenderRubyRun::renderName): made private
+        (WebCore::RenderRubyRun::createsAnonymousWrapper): return true
+
 2009-12-15  Nate Chapin  <japhet@chromium.org>
 

trunk/WebCore/rendering/RenderRuby.h

@@ -55 +55 @@
     virtual ~RenderRubyAsInline();
 
-    virtual const char* renderName() const { return "RenderRuby (inline)"; }
-
-    virtual bool isRuby() const { return true; }
-
     virtual bool isChildAllowed(RenderObject*, RenderStyle*) const;
     virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
     virtual void removeChild(RenderObject* child);
+
+private:
+    virtual bool isRuby() const { return true; }
+    virtual const char* renderName() const { return "RenderRuby (inline)"; }
+    virtual bool createsAnonymousWrapper() const { return true; }
+    virtual void removeLeftoverAnonymousBlock(RenderBlock*) { ASSERT_NOT_REACHED(); }
 };
 
@@ -70 +72 @@
     virtual ~RenderRubyAsBlock();
 
-    virtual const char* renderName() const { return "RenderRuby (block)"; }
-
-    virtual bool isRuby() const { return true; }
-
     virtual bool isChildAllowed(RenderObject*, RenderStyle*) const;
     virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
     virtual void removeChild(RenderObject* child);
+
+private:
+    virtual bool isRuby() const { return true; }
+    virtual const char* renderName() const { return "RenderRuby (block)"; }
+    virtual bool createsAnonymousWrapper() const { return true; }
+    virtual void removeLeftoverAnonymousBlock(RenderBlock*) { ASSERT_NOT_REACHED(); }
 };
 

trunk/WebCore/rendering/RenderRubyRun.h

@@ -49 +49 @@
     virtual void destroy();
 
-    virtual const char* renderName() const { return "RenderRubyRun (anonymous)"; }
-
-    virtual bool isRubyRun() const { return true; }
-
     bool hasRubyText() const;
     bool hasRubyBase() const;
@@ -71 +67 @@
 protected:
     RenderRubyBase* createRubyBase() const;
-    
+
 private:
+    virtual bool isRubyRun() const { return true; }
+    virtual const char* renderName() const { return "RenderRubyRun (anonymous)"; }
+    virtual bool createsAnonymousWrapper() const { return true; }
+    virtual void removeLeftoverAnonymousBlock(RenderBlock*) { }
+
     bool m_beingDestroyed;
 };