Bug 81581 - visual word movement: crashes on CSS generated content
: visual word movement: crashes on CSS generated content
Status: RESOLVED FIXED
Product: WebKit
Classification: Unclassified
Component: HTML Editing
: 528+ (Nightly build)
: Unspecified Unspecified
: P2 Normal
Assigned To: Nobody
:
Depends on:
Blocks: 25298
  Show dependency treegraph
 
Reported: 2012-03-19 16:08 PDT by Xiaomei Ji
Modified: 2012-03-20 16:50 PDT (History)
2 users (show)

See Also:


Attachments
patch w/ layout test (4.38 KB, patch)
2012-03-19 16:26 PDT, Xiaomei Ji
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Xiaomei Ji 2012-03-19 16:08:47 PDT
visual word movement: crashes on CSS generated content
Comment 1 Xiaomei Ji 2012-03-19 16:26:17 PDT
Created attachment 132710 [details]
patch w/ layout test

Ryosuke, Thanks for the bug report!
Comment 2 Xiaomei Ji 2012-03-19 16:32:02 PDT
I checked other pointer dereference codes, and I think they are mostly looks ok.

How about the following when textBox is a not-null-InlineTextBox?
textBox->textRenderer()->text()->characters()

I think it is fine since InlineTextBox must have a text renderer. And it should have text()->characters() although it could be null. There is similar usage in 
https://cs.corp.google.com/#chrome/src/third_party/WebKit/Source/WebCore/rendering/InlineTextBox.cpp&q=textRenderer()%20package:%5Echrome$%20file:%5Esrc/third_party/WebKit/.*.cpp&type=cs&l=346
Comment 3 Ryosuke Niwa 2012-03-20 10:55:24 PDT
Comment on attachment 132710 [details]
patch w/ layout test

View in context: https://bugs.webkit.org/attachment.cgi?id=132710&action=review

> LayoutTests/editing/selection/move-by-word-visually-crash-test-css-generated-content.html:1
> +<head>

No DOCTYPE?
Comment 4 Xiaomei Ji 2012-03-20 16:22:51 PDT
Comment on attachment 132710 [details]
patch w/ layout test

View in context: https://bugs.webkit.org/attachment.cgi?id=132710&action=review

>> LayoutTests/editing/selection/move-by-word-visually-crash-test-css-generated-content.html:1
>> +<head>
> 
> No DOCTYPE?

I will update all the tests in another patch.
Comment 5 WebKit Review Bot 2012-03-20 16:50:10 PDT
Comment on attachment 132710 [details]
patch w/ layout test

Clearing flags on attachment: 132710

Committed r111469: <http://trac.webkit.org/changeset/111469>
Comment 6 WebKit Review Bot 2012-03-20 16:50:15 PDT
All reviewed patches have been landed.  Closing bug.