Bug 44804 – Crashes in RenderMathMLRoot::layout() and RenderMathMLRoot::paint()

• Component: MathML
• Status: RESOLVED FIXED

[Beth Dakin]

All of the calls to firstChild() and lastChild() in RenderMathMLRoot::layout() and RenderMathMLRoot::paint() need to be null checked.

<rdar://problem/8342055>

[Beth Dakin]

Created attachment 65783 [details]
Test Case 1

[Beth Dakin]

Created attachment 65784 [details]
Test Case 2

[Beth Dakin]

Created attachment 65785 [details]
Patch

The attached test cases need to be reduced into layout tests before this patch can be committed, but I am attaching it now anyway.

[Sam Weinig]

Comment on attachment 65785 [details]
Patch

Please land with test.

[Sam Weinig]

Comment on attachment 65785 [details]
Patch

Please land with test.

[Beth Dakin]

Yay! Thanks Sam :-) I will hold off on landing for now until I reduce the test.

[Daniel Bates]

Created attachment 65881 [details]
Reduced Test Case 1

I was able to reduce the first test case <https://bugs.webkit.org/attachment.cgi?id=65783> to:

<math>
    <mroot><mi></mi></mroot>
</math>

Without the patch, both this and <https://bugs.webkit.org/attachment.cgi?id=65783> crash at:

int indexShift = indexBox->offsetWidth() + topStartShift;

because indexBox is null.

[Daniel Bates]

Created attachment 65882 [details]
Reduced Test Case 2

I was able to reduce the second test case <https://bugs.webkit.org/attachment.cgi?id=65784> to:

<math>
    <mroot></mroot>
</math>

Without the patch, both this and <https://bugs.webkit.org/attachment.cgi?id=65784> crash at:

int maxHeight = toRenderBoxModelObject(lastChild())->offsetHeight();

because lastChild() returns a null pointer.

[Beth Dakin]

Thanks Dan!! (And Darin!) I will be landing shortly.

[Beth Dakin]

Fixed with http://trac.webkit.org/changeset/66403