Bug 112157 – [CSS Exclusions] Specifying polygonal -webkit-shape-inside value can crash browser (debug mode)

• Component: CSS
• Status: RESOLVED FIXED

[Hans Muller]

Created attachment 192749 [details]
Test case.

Pressing the button in the attached HTML file will crash a debug build of Safari.  The crash is caused by the following ASSERT fail, from line 1306 of RenderBlockLineLayout.cpp:

    const SegmentRangeList& segmentRanges = exclusionShapeInsideInfo->segmentRanges();
    ASSERT(segmentRanges.size());

    for (size_t i = 0; i < segmentRanges.size(); i++) {
        InlineIterator segmentStart = segmentRanges[i].start;
        InlineIterator segmentEnd = segmentRanges[i].end;
        if (i) {
            ASSERT(segmentStart.m_obj); // FAIL
            BidiRun* segmentMarker = createRun(segmentStart.m_pos, segmentStart.m_pos, segmentStart.m_obj, topResolver);
            segmentMarker->m_startsSegment = true;
            bidiRuns.addRun(segmentMarker);
            // Do not collapse midpoints between segments
            topResolver.midpointState().betweenMidpoints = false;
        }
        topResolver.setPosition(segmentStart, numberOfIsolateAncestors(segmentStart));
        constructBidiRunsForSegment(topResolver, bidiRuns, segmentEnd, override, previousLineBrokeCleanly);
    }

[Hans Muller]

Created attachment 192966 [details]
Patch

[Hans Muller]

Created attachment 193017 [details]
Patch

Refactored the logic per feedback from Bear,  and added trailing whitespace variations to the tests.

[Dave Hyatt]

Comment on attachment 193017 [details]
Patch

r=me

[WebKit Review Bot]

Comment on attachment 193017 [details]
Patch

Clearing flags on attachment: 193017

Committed r146073: <http://trac.webkit.org/changeset/146073>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.