Bug 253165
| Summary: | Make sure child is a RenderElement before trying to pass it into shouldChildInlineMarginContributeToContainerIntrinsicSize in RenderBlock::computeBlockPreferredLogicalWidths | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Sammy Gill <sgill26> |
| Component: | Layout and Rendering | Assignee: | Sammy Gill <sgill26> |
| Status: | RESOLVED FIXED | ||
| Severity: | Normal | CC: | bfulgham, simon.fraser, webkit-bug-importer, zalan |
| Priority: | P2 | Keywords: | InRadar |
| Version: | WebKit Nightly Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
Sammy Gill
The assumption about this code currently is that child cannot be a RenderText within RenderBlock::computeBlockPreferredLogicalWidths. That assumption is wrong and can lead to a nullptr dereference. We should check the result of the cast before trying to pass it in
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Sammy Gill
rdar://105848359
Radar WebKit Bug Importer
<rdar://problem/106092185>
Sammy Gill
Pull request: https://github.com/WebKit/WebKit/pull/10882
Sammy Gill
rdar://105848359
EWS
Committed 261063@main (02bb8ae9d573): <https://commits.webkit.org/261063@main>
Reviewed commits have been landed. Closing PR #10882 and removing active labels.
EWS
Committed 259548.371@safari-7615-branch (6f9b18dfa549): <https://commits.webkit.org/259548.371@safari-7615-branch>
Reviewed commits have been landed. Closing PR #432 and removing active labels.
Sammy Gill
*** Bug 252975 has been marked as a duplicate of this bug. ***
Sammy Gill
*** Bug 253182 has been marked as a duplicate of this bug. ***