Bug 81581 - visual word movement: crashes on CSS generated content
: visual word movement: crashes on CSS generated content
Status: RESOLVED FIXED
: WebKit
HTML Editing
: 528+ (Nightly build)
: Unspecified Unspecified
: P2 Normal
Assigned To:
:
:
:
: 25298
  Show dependency treegraph
 
Reported: 2012-03-19 16:08 PST by
Modified: 2012-03-20 16:50 PST (History)


Attachments
patch w/ layout test (4.38 KB, patch)
2012-03-19 16:26 PST, Xiaomei Ji
no flags Review Patch | Details | Formatted Diff | Diff


Note

You need to log in before you can comment on or make changes to this bug.


Description From 2012-03-19 16:08:47 PST
visual word movement: crashes on CSS generated content
------- Comment #1 From 2012-03-19 16:26:17 PST -------
Created an attachment (id=132710) [details]
patch w/ layout test

Ryosuke, Thanks for the bug report!
------- Comment #2 From 2012-03-19 16:32:02 PST -------
I checked other pointer dereference codes, and I think they are mostly looks ok.

How about the following when textBox is a not-null-InlineTextBox?
textBox->textRenderer()->text()->characters()

I think it is fine since InlineTextBox must have a text renderer. And it should have text()->characters() although it could be null. There is similar usage in 
https://cs.corp.google.com/#chrome/src/third_party/WebKit/Source/WebCore/rendering/InlineTextBox.cpp&q=textRenderer()%20package:%5Echrome$%20file:%5Esrc/third_party/WebKit/.*.cpp&type=cs&l=346
------- Comment #3 From 2012-03-20 10:55:24 PST -------
(From update of attachment 132710 [details])
View in context: https://bugs.webkit.org/attachment.cgi?id=132710&action=review

> LayoutTests/editing/selection/move-by-word-visually-crash-test-css-generated-content.html:1
> +<head>

No DOCTYPE?
------- Comment #4 From 2012-03-20 16:22:51 PST -------
(From update of attachment 132710 [details])
View in context: https://bugs.webkit.org/attachment.cgi?id=132710&action=review

>> LayoutTests/editing/selection/move-by-word-visually-crash-test-css-generated-content.html:1
>> +<head>
> 
> No DOCTYPE?

I will update all the tests in another patch.
------- Comment #5 From 2012-03-20 16:50:10 PST -------
(From update of attachment 132710 [details])
Clearing flags on attachment: 132710

Committed r111469: <http://trac.webkit.org/changeset/111469>
------- Comment #6 From 2012-03-20 16:50:15 PST -------
All reviewed patches have been landed.  Closing bug.