Bug 145942 - Be more defensive at renderer type checking when initializing flow segments.
Summary: Be more defensive at renderer type checking when initializing flow segments.
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Layout and Rendering (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: zalan
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-06-12 15:00 PDT by zalan
Modified: 2015-06-12 20:25 PDT (History)
6 users (show)

See Also:


Attachments
Patch (2.67 KB, patch)
2015-06-12 15:25 PDT, zalan
no flags Details | Formatted Diff | Diff
Patch (2.82 KB, patch)
2015-06-12 19:00 PDT, zalan
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description zalan 2015-06-12 15:00:36 PDT
If we miss invalidating simple line layout path properly, we could end up in FlowContents->initializeSegments with a renderer that we don't support yet.
Comment 1 zalan 2015-06-12 15:25:17 PDT
Created attachment 254824 [details]
Patch
Comment 2 zalan 2015-06-12 15:25:48 PDT
It results in broken rendering (missing pieces) vs. crash.
Comment 3 Antti Koivisto 2015-06-12 15:52:07 PDT
Comment on attachment 254824 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=254824&action=review

> Source/WebCore/rendering/SimpleLineLayoutFlowContents.cpp:50
>              continue;
> -        }
> -        ASSERT(is<RenderText>(child));
> -        const auto& textChild = downcast<RenderText>(child);
> -        unsigned textLength = textChild.text()->length();
> -        segments.append(FlowContents::Segment { startPosition, startPosition + textLength, textChild.text(), textChild });
> -        startPosition += textLength;
> +        } else if (is<RenderText>(child)) {

No need to say 'else' after 'continue'.
Comment 4 Antti Koivisto 2015-06-12 15:55:06 PDT
Comment on attachment 254824 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=254824&action=review

> Source/WebCore/rendering/SimpleLineLayoutFlowContents.cpp:56
> +            startPosition += textLength;
> +        } else
> +            ASSERT_NOT_REACHED();

This too could do continue without else.
Comment 5 zalan 2015-06-12 19:00:52 PDT
Created attachment 254846 [details]
Patch
Comment 6 WebKit Commit Bot 2015-06-12 20:25:36 PDT
Comment on attachment 254846 [details]
Patch

Clearing flags on attachment: 254846

Committed r185531: <http://trac.webkit.org/changeset/185531>
Comment 7 WebKit Commit Bot 2015-06-12 20:25:41 PDT
All reviewed patches have been landed.  Closing bug.