Bug 81581 – visual word movement: crashes on CSS generated content

Bug 81581 - visual word movement: crashes on CSS generated content


Summary:	visual word movement: crashes on CSS generated content

Status:	RESOLVED FIXED

Product:	WebKit
Component:	HTML Editing
Version:	528+ (Nightly build)
Platform:	Unspecified Unspecified

Importance:	P2 Normal
Assigned To:	Nobody

URL:
Keywords:

Depends on:
Blocks:	25298
	Show dependency tree / graph

Reported:	2012-03-19 16:08 PST by Xiaomei Ji
Modified:	2012-03-20 16:50 PST (History)

Attachments
patch w/ layout test (4.38 KB, patch) 2012-03-19 16:26 PST, Xiaomei Ji	no flags	Review Patch \| Details \| Formatted Diff \| Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note

You need to log in before you can comment on or make changes to this bug.

Description From Xiaomei Ji 2012-03-19 16:08:47 PST

visual word movement: crashes on CSS generated content

------- Comment #1 From Xiaomei Ji 2012-03-19 16:26:17 PST -------

Created an attachment (id=132710) [details]
patch w/ layout test

Ryosuke, Thanks for the bug report!

------- Comment #2 From Xiaomei Ji 2012-03-19 16:32:02 PST -------

I checked other pointer dereference codes, and I think they are mostly looks ok.

How about the following when textBox is a not-null-InlineTextBox?
textBox->textRenderer()->text()->characters()

I think it is fine since InlineTextBox must have a text renderer. And it should have text()->characters() although it could be null. There is similar usage in 
https://cs.corp.google.com/#chrome/src/third_party/WebKit/Source/WebCore/rendering/InlineTextBox.cpp&q=textRenderer()%20package:%5Echrome$%20file:%5Esrc/third_party/WebKit/.*.cpp&type=cs&l=346

------- Comment #3 From Ryosuke Niwa 2012-03-20 10:55:24 PST -------

(From update of attachment 132710 [details])
View in context: https://bugs.webkit.org/attachment.cgi?id=132710&action=review

> LayoutTests/editing/selection/move-by-word-visually-crash-test-css-generated-content.html:1
> +<head>

No DOCTYPE?

------- Comment #4 From Xiaomei Ji 2012-03-20 16:22:51 PST -------

(From update of attachment 132710 [details])
View in context: https://bugs.webkit.org/attachment.cgi?id=132710&action=review

>> LayoutTests/editing/selection/move-by-word-visually-crash-test-css-generated-content.html:1
>> +<head>
> 
> No DOCTYPE?

I will update all the tests in another patch.

------- Comment #5 From WebKit Review Bot 2012-03-20 16:50:10 PST -------

(From update of attachment 132710 [details])
Clearing flags on attachment: 132710

Committed r111469: <http://trac.webkit.org/changeset/111469>

------- Comment #6 From WebKit Review Bot 2012-03-20 16:50:15 PST -------

All reviewed patches have been landed.  Closing bug.