Attachment 64782 Details for Bug 44207 – Patch + tests

[patch] Patch + tests

forReview.txt (text/plain), 6.34 KB, created by Beth Dakin on 2010-08-18 15:38:51 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Beth Dakin

Created: 2010-08-18 15:38:51 PDT

Size: 6.34 KB

patch

obsolete

>Index: WebCore/ChangeLog
>===================================================================
>--- WebCore/ChangeLog	(revision 65633)
>+++ WebCore/ChangeLog	(working copy)
>@@ -1,3 +1,18 @@
>+2010-08-18  Beth Dakin  <bdakin@apple.com>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Fix for https://bugs.webkit.org/show_bug.cgi?id=44207 Empty mfrac 
>+        and empty munderover cause crashes
>+       -and corresponding-
>+        <rdar://problem/8325160>
>+
>+        This is just a  matter of adding null checks in the right places.
>+        * mathml/RenderMathMLFraction.cpp:
>+        (WebCore::RenderMathMLFraction::baselinePosition):
>+        * mathml/RenderMathMLUnderOver.cpp:
>+        (WebCore::RenderMathMLUnderOver::baselinePosition):
>+
> 2010-08-18  Adam Barth  <abarth@webkit.org>
> 
>         Reviewed by David Levin.
>Index: WebCore/mathml/RenderMathMLFraction.cpp
>===================================================================
>--- WebCore/mathml/RenderMathMLFraction.cpp	(revision 65440)
>+++ WebCore/mathml/RenderMathMLFraction.cpp	(working copy)
>@@ -176,7 +176,7 @@ void RenderMathMLFraction::paint(PaintIn
> 
> int RenderMathMLFraction::baselinePosition(bool firstLine, bool isRootLineBox) const
> {
>-    if (firstChild()->isRenderMathMLBlock()) {
>+    if (firstChild() && firstChild()->isRenderMathMLBlock()) {
>         RenderMathMLBlock* numerator = toRenderMathMLBlock(firstChild());
>         // FIXME: the baseline should adjust so the fraction line aligns
>         // relative certain operators (e.g. aligns with the horizontal
>Index: WebCore/mathml/RenderMathMLUnderOver.cpp
>===================================================================
>--- WebCore/mathml/RenderMathMLUnderOver.cpp	(revision 65440)
>+++ WebCore/mathml/RenderMathMLUnderOver.cpp	(working copy)
>@@ -236,35 +236,35 @@ void RenderMathMLUnderOver::layout() 
> 
> int RenderMathMLUnderOver::baselinePosition(bool firstLine, bool isRootLineBox) const
> {
>+    RenderObject* current = firstChild();
>+    if (!current)
>+        return RenderBlock::baselinePosition(firstLine, isRootLineBox);
>+
>     int baseline = 0;
>-    RenderObject* current = 0;
>     switch (m_kind) {
>     case UnderOver:
>     case Over:
>-        current = firstChild();
>         baseline += getOffsetHeight(current);
>         current = current->nextSibling();
>         if (current) {
>             // actual base
>             RenderObject* base = current->firstChild();
>+            if (!base)
>+                break;
>             baseline += base->baselinePosition(firstLine, isRootLineBox);
>             // added the negative top margin
>             baseline += current->style()->marginTop().value();
>-            // FIXME: Where is the extra 2-3px adjusted for zoom coming from?
>-            float zoomFactor = style()->effectiveZoom();
>-            baseline += static_cast<int>((zoomFactor > 1.25 ? 2 : 3) * zoomFactor);
>         }
>         break;
>     case Under:
>-        current = firstChild();
>-        if (current) {
>-            RenderObject* base = current->firstChild();
>+        RenderObject* base = current->firstChild();
>+        if (base)
>             baseline += base->baselinePosition(true);
>-            // FIXME: Where is the extra 2-3px adjusted for zoom coming from?
>-            float zoomFactor = style()->effectiveZoom();
>-            baseline += static_cast<int>((zoomFactor > 1.25 ? 2 : 3) * zoomFactor);
>-        }
>     }
>+
>+    // FIXME: Where is the extra 2-3px adjusted for zoom coming from?
>+    float zoomFactor = style()->effectiveZoom();
>+    baseline += static_cast<int>((zoomFactor > 1.25 ? 2 : 3) * zoomFactor);
>     return baseline;
> }
> 
>Index: LayoutTests/ChangeLog
>===================================================================
>--- LayoutTests/ChangeLog	(revision 65634)
>+++ LayoutTests/ChangeLog	(working copy)
>@@ -1,3 +1,16 @@
>+2010-08-18  Beth Dakin  <bdakin@apple.com>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Tests for https://bugs.webkit.org/show_bug.cgi?id=44207 Empty mfrac 
>+        and empty munderover cause crashes
>+       -and corresponding-
>+        <rdar://problem/8325160>
>+        * mathml/EmptyMFracCrash-expected.txt: Added.
>+        * mathml/EmptyMFracCrash.xhtml: Added.
>+        * mathml/EmptyMunderOverCrash-expected.txt: Added.
>+        * mathml/EmptyMunderOverCrash.xhtml: Added.
>+
> 2010-08-18  Ojan Vafai  <ojan@chromium.org>
> 
>         Reviewed by Tony Chang.
>Index: LayoutTests/mathml/EmptyMFracCrash-expected.txt
>===================================================================
>--- LayoutTests/mathml/EmptyMFracCrash-expected.txt	(revision 0)
>+++ LayoutTests/mathml/EmptyMFracCrash-expected.txt	(revision 0)
>@@ -0,0 +1 @@
>+This test passes if it does not crash.
>Index: LayoutTests/mathml/EmptyMFracCrash.xhtml
>===================================================================
>--- LayoutTests/mathml/EmptyMFracCrash.xhtml	(revision 0)
>+++ LayoutTests/mathml/EmptyMFracCrash.xhtml	(revision 0)
>@@ -0,0 +1,17 @@
>+<?xml version="1.0" encoding="UTF-8"?>
>+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML" xml:lang="en">
>+<head>
>+<script>
>+    if (window.layoutTestController)
>+        layoutTestController.dumpAsText();
>+</script>
>+</head>
>+<body>
>+    <math xmlns="http://www.w3.org/1998/Math/MathML"> 
>+        <mtext>This test passes if it does not crash.</mtext>
>+        <mrow> 
>+            <mfrac></mfrac> 
>+        </mrow> 
>+    </math>
>+</body>
>+</html>
>Index: LayoutTests/mathml/EmptyMunderOverCrash-expected.txt
>===================================================================
>--- LayoutTests/mathml/EmptyMunderOverCrash-expected.txt	(revision 0)
>+++ LayoutTests/mathml/EmptyMunderOverCrash-expected.txt	(revision 0)
>@@ -0,0 +1 @@
>+This test passes if it does not crash.
>Index: LayoutTests/mathml/EmptyMunderOverCrash.xhtml
>===================================================================
>--- LayoutTests/mathml/EmptyMunderOverCrash.xhtml	(revision 0)
>+++ LayoutTests/mathml/EmptyMunderOverCrash.xhtml	(revision 0)
>@@ -0,0 +1,17 @@
>+<?xml version="1.0" encoding="UTF-8"?>
>+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML" xml:lang="en">
>+<head>
>+<script>
>+    if (window.layoutTestController)
>+        layoutTestController.dumpAsText();
>+</script>
>+</head>
>+<body>
>+<math xmlns="http://www.w3.org/1998/Math/MathML"> 
>+    <mtext>This test passes if it does not crash.</mtext> 
>+    <mrow> 
>+        <munderover></munderover> 
>+    </mrow> 
>+</math>
>+</body>
>+</html>

Flags:

sam: review+

Actions: View | Formatted Diff | Diff

Attachments on bug 44207: 64782