Bug 44804

Summary: Crashes in RenderMathMLRoot::layout() and RenderMathMLRoot::paint()
Product: WebKit Reporter: Beth Dakin <bdakin>
Component: MathMLAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: bdakin, dbates
Priority: P2 Keywords: HasReduction, InRadar
Version: 528+ (Nightly build)   
Hardware: PC   
OS: OS X 10.5   
Attachments:
Description Flags
Test Case 1
none
Test Case 2
none
Patch
sam: review+
Reduced Test Case 1
none
Reduced Test Case 2 none

Description Beth Dakin 2010-08-27 16:30:53 PDT 
All of the calls to firstChild() and lastChild() in RenderMathMLRoot::layout() and RenderMathMLRoot::paint() need to be null checked.

<rdar://problem/8342055>
Comment 1 Beth Dakin 2010-08-27 16:31:55 PDT 
Created attachment 65783 [details]
Test Case 1
Comment 2 Beth Dakin 2010-08-27 16:32:19 PDT 
Created attachment 65784 [details]
Test Case 2
Comment 3 Beth Dakin 2010-08-27 16:34:07 PDT 
Created attachment 65785 [details]
Patch

The attached test cases need to be reduced into layout tests before this patch can be committed, but I am attaching it now anyway.
Comment 4 Sam Weinig 2010-08-27 19:23:36 PDT 
Comment on attachment 65785 [details]
Patch

Please land with test.
Comment 5 Sam Weinig 2010-08-27 19:23:36 PDT 
Comment on attachment 65785 [details]
Patch

Please land with test.
Comment 6 Beth Dakin 2010-08-28 12:56:38 PDT 
Yay! Thanks Sam :-) I will hold off on landing for now until I reduce the test.
Comment 7 Daniel Bates 2010-08-29 23:25:55 PDT 
Created attachment 65881 [details]
Reduced Test Case 1

I was able to reduce the first test case <https://bugs.webkit.org/attachment.cgi?id=65783> to:

<math>
    <mroot><mi></mi></mroot>
</math>

Without the patch, both this and <https://bugs.webkit.org/attachment.cgi?id=65783> crash at:

int indexShift = indexBox->offsetWidth() + topStartShift;

because indexBox is null.
Comment 8 Daniel Bates 2010-08-29 23:30:30 PDT 
Created attachment 65882 [details]
Reduced Test Case 2

I was able to reduce the second test case <https://bugs.webkit.org/attachment.cgi?id=65784> to:

<math>
    <mroot></mroot>
</math>

Without the patch, both this and <https://bugs.webkit.org/attachment.cgi?id=65784> crash at:

int maxHeight = toRenderBoxModelObject(lastChild())->offsetHeight();

because lastChild() returns a null pointer.
Comment 9 Beth Dakin 2010-08-30 10:37:19 PDT 
Thanks Dan!! (And Darin!) I will be landing shortly.
Comment 10 Beth Dakin 2010-08-30 13:04:16 PDT 
Fixed with http://trac.webkit.org/changeset/66403