Bug 145942 – Be more defensive at renderer type checking when initializing flow segments.

• Status: RESOLVED
• Resolution: FIXED
• Component: Layout and Rendering

[zalan]

If we miss invalidating simple line layout path properly, we could end up in FlowContents->initializeSegments with a renderer that we don't support yet.

[zalan]

Created attachment 254824 [details]
Patch

[zalan]

It results in broken rendering (missing pieces) vs. crash.

[Antti Koivisto]

Comment on attachment 254824 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=254824&action=review

> Source/WebCore/rendering/SimpleLineLayoutFlowContents.cpp:50
>              continue;
> -        }
> -        ASSERT(is<RenderText>(child));
> -        const auto& textChild = downcast<RenderText>(child);
> -        unsigned textLength = textChild.text()->length();
> -        segments.append(FlowContents::Segment { startPosition, startPosition + textLength, textChild.text(), textChild });
> -        startPosition += textLength;
> +        } else if (is<RenderText>(child)) {

No need to say 'else' after 'continue'.

[Antti Koivisto]

Comment on attachment 254824 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=254824&action=review

> Source/WebCore/rendering/SimpleLineLayoutFlowContents.cpp:56
> +            startPosition += textLength;
> +        } else
> +            ASSERT_NOT_REACHED();

This too could do continue without else.

[zalan]

Created attachment 254846 [details]
Patch

[WebKit Commit Bot]

Comment on attachment 254846 [details]
Patch

Clearing flags on attachment: 254846

Committed r185531: <http://trac.webkit.org/changeset/185531>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.