Bug 81581 – visual word movement: crashes on CSS generated content

Bug 81581 - visual word movement: crashes on CSS generated content


Summary:	visual word movement: crashes on CSS generated content

Status:	RESOLVED FIXED

Product:	WebKit
Classification:	Unclassified
Component:	HTML Editing
Version:	528+ (Nightly build)
Platform:	Unspecified Unspecified

Importance:	P2 Normal
Assigned To:	Nobody

URL:
Keywords:

Depends on:
Blocks:	25298
	Show dependency tree / graph

Reported:	2012-03-19 16:08 PDT by Xiaomei Ji
Modified:	2012-03-20 16:50 PDT (History)
CC List:	2 users (show)

See Also:

Attachments
patch w/ layout test (4.38 KB, patch) 2012-03-19 16:26 PDT, Xiaomei Ji	no flags	Details \| Formatted Diff \| Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Xiaomei Ji 2012-03-19 16:08:47 PDT

visual word movement: crashes on CSS generated content

Comment 1 Xiaomei Ji 2012-03-19 16:26:17 PDT

Created attachment 132710 [details]
patch w/ layout test

Ryosuke, Thanks for the bug report!

Comment 2 Xiaomei Ji 2012-03-19 16:32:02 PDT

I checked other pointer dereference codes, and I think they are mostly looks ok.

How about the following when textBox is a not-null-InlineTextBox?
textBox->textRenderer()->text()->characters()

I think it is fine since InlineTextBox must have a text renderer. And it should have text()->characters() although it could be null. There is similar usage in 
https://cs.corp.google.com/#chrome/src/third_party/WebKit/Source/WebCore/rendering/InlineTextBox.cpp&q=textRenderer()%20package:%5Echrome$%20file:%5Esrc/third_party/WebKit/.*.cpp&type=cs&l=346

Comment 3 Ryosuke Niwa 2012-03-20 10:55:24 PDT

Comment on attachment 132710 [details]
patch w/ layout test

View in context: https://bugs.webkit.org/attachment.cgi?id=132710&action=review

> LayoutTests/editing/selection/move-by-word-visually-crash-test-css-generated-content.html:1
> +<head>

No DOCTYPE?

Comment 4 Xiaomei Ji 2012-03-20 16:22:51 PDT

Comment on attachment 132710 [details]
patch w/ layout test

View in context: https://bugs.webkit.org/attachment.cgi?id=132710&action=review

>> LayoutTests/editing/selection/move-by-word-visually-crash-test-css-generated-content.html:1
>> +<head>
> 
> No DOCTYPE?

I will update all the tests in another patch.

Comment 5 WebKit Review Bot 2012-03-20 16:50:10 PDT

Comment on attachment 132710 [details]
patch w/ layout test

Clearing flags on attachment: 132710

Committed r111469: <http://trac.webkit.org/changeset/111469>

Comment 6 WebKit Review Bot 2012-03-20 16:50:15 PDT

All reviewed patches have been landed.  Closing bug.