Changeset 88730 in webkit

Timestamp:

Jun 13, 2011 4:20:47 PM (13 years ago)

Author:

commit-queue@webkit.org

Message:

2011-06-13 Jeffrey Pfau <​jpfau@apple.com>

Reviewed by Darin Adler.

Crash in WebCore::RenderMathMLUnderOver::layout()
​https://bugs.webkit.org/show_bug.cgi?id=57900

Added a test that tries to remove the children of munder, mover and munderover elements.

• mathml/munderover-remove-children-expected.txt: Added.
• mathml/munderover-remove-children.html: Added.

2011-06-13 Jeffrey Pfau <​jpfau@apple.com>

Reviewed by Darin Adler.

Crash in WebCore::RenderMathMLUnderOver::layout()
​https://bugs.webkit.org/show_bug.cgi?id=57900

Add more null checks so that removing children in MathML elements does not cause crashes.
Note that this only half fixes the third repro in the Bugzilla bug, as another bug will
still crash that repro.

Test: mathml/munderover-remove-children.html

• rendering/mathml/RenderMathMLSubSup.cpp: (WebCore::RenderMathMLSubSup::stretchToHeight):
• rendering/mathml/RenderMathMLUnderOver.cpp: (WebCore::RenderMathMLUnderOver::layout): (WebCore::RenderMathMLUnderOver::nonOperatorHeight):

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/mathml/munderover-remove-children-expected.txt (added)
• LayoutTests/mathml/munderover-remove-children.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp (modified) (1 diff)
• Source/WebCore/rendering/mathml/RenderMathMLUnderOver.cpp (modified) (6 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-06-13  Jeffrey Pfau  <jpfau@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Crash in WebCore::RenderMathMLUnderOver::layout()
+        https://bugs.webkit.org/show_bug.cgi?id=57900
+
+        Added a test that tries to remove the children of munder, mover and munderover elements.
+
+        * mathml/munderover-remove-children-expected.txt: Added.
+        * mathml/munderover-remove-children.html: Added.
+
 2011-06-13  Wyatt Carss  <wcarss@google.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-06-13  Jeffrey Pfau  <jpfau@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Crash in WebCore::RenderMathMLUnderOver::layout()
+        https://bugs.webkit.org/show_bug.cgi?id=57900
+
+        Add more null checks so that removing children in MathML elements does not cause crashes.
+        Note that this only half fixes the third repro in the Bugzilla bug, as another bug will
+        still crash that repro.
+
+        Test: mathml/munderover-remove-children.html
+
+        * rendering/mathml/RenderMathMLSubSup.cpp:
+        (WebCore::RenderMathMLSubSup::stretchToHeight):
+        * rendering/mathml/RenderMathMLUnderOver.cpp:
+        (WebCore::RenderMathMLUnderOver::layout):
+        (WebCore::RenderMathMLUnderOver::nonOperatorHeight):
+
 2011-06-13  Dmitry Lomov  <dslomov@google.com>
 

trunk/Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp

@@ -110 +110 @@
         return;
     
-    if (base->firstChild()->isRenderMathMLBlock()) {
+    if (base->firstChild() && base->firstChild()->isRenderMathMLBlock()) {
         RenderMathMLBlock* block = toRenderMathMLBlock(base->firstChild());
         block->stretchToHeight(static_cast<int>(gSubSupStretch * height));

trunk/Source/WebCore/rendering/mathml/RenderMathMLUnderOver.cpp

@@ -156 +156 @@
             // FIXME: descending glyphs intrude into base (e.g. lowercase y over base)
             // FIXME: bases that ascend higher than the line box intrude into the over
-            if (!over->firstChild()->isBoxModelObject())
+            if (!over->firstChild() || !over->firstChild()->isBoxModelObject())
                 break;
             
@@ -184 +184 @@
             // actual base
             base = base->firstChild();
-            if (!base->isBoxModelObject())
+            if (!base || !base->isBoxModelObject())
                 break;
             
@@ -208 +208 @@
             // FIXME: descending glyphs intrude into base (e.g. lowercase y over base)
             // FIXME: bases that ascend higher than the line box intrude into the over
-            if (!over->firstChild()->isBoxModelObject())
+            if (!over->firstChild() || !over->firstChild()->isBoxModelObject())
                 break;
             int overSpacing = static_cast<int>(gOverSpacingAdjustment * (getOffsetHeight(over) - toRenderBoxModelObject(over->firstChild())->baselinePosition(AlphabeticBaseline, true, HorizontalLine)));
@@ -225 +225 @@
                 // actual base
                 base = base->firstChild();
-                if (!base->isBoxModelObject())
+                if (!base || !base->isBoxModelObject())
                     break;
 
@@ -233 +233 @@
                 
                 RenderObject* under = lastChild();
-                if (under && under->firstChild()->isRenderInline() && underSpacing > 0)
+                if (under && under->firstChild() && under->firstChild()->isRenderInline() && underSpacing > 0)
                     under->style()->setMarginTop(Length(-underSpacing, Fixed));
                 
@@ -283 +283 @@
     int nonOperators = 0;
     for (RenderObject* current = firstChild(); current; current = current->nextSibling()) {
-        if (current->firstChild()->isRenderMathMLBlock()) {
+        if (current->firstChild() && current->firstChild()->isRenderMathMLBlock()) {
             RenderMathMLBlock* block = toRenderMathMLBlock(current->firstChild());
             if (!block->isRenderMathMLOperator())