Bug 81581 - visual word movement: crashes on CSS generated content
Summary: visual word movement: crashes on CSS generated content
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: HTML Editing (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks: 25298
  Show dependency tree / graph
 
Reported: 2012-03-19 16:08 PDT by Xiaomei Ji
Modified: 2012-03-20 16:50 PDT (History)
2 users (show)

See Also:

Attachments
patch w/ layout test (4.38 KB, patch)
2012-03-19 16:26 PDT, Xiaomei Ji 		no flags Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Xiaomei Ji 2012-03-19 16:08:47 PDT 
visual word movement: crashes on CSS generated content
Comment 1 Xiaomei Ji 2012-03-19 16:26:17 PDT 
Created attachment 132710 [details]
patch w/ layout test

Ryosuke, Thanks for the bug report!
Comment 2 Xiaomei Ji 2012-03-19 16:32:02 PDT 
I checked other pointer dereference codes, and I think they are mostly looks ok.

How about the following when textBox is a not-null-InlineTextBox?
textBox->textRenderer()->text()->characters()

I think it is fine since InlineTextBox must have a text renderer. And it should have text()->characters() although it could be null. There is similar usage in 
https://cs.corp.google.com/#chrome/src/third_party/WebKit/Source/WebCore/rendering/InlineTextBox.cpp&q=textRenderer()%20package:%5Echrome$%20file:%5Esrc/third_party/WebKit/.*.cpp&type=cs&l=346
Comment 3 Ryosuke Niwa 2012-03-20 10:55:24 PDT 
Comment on attachment 132710 [details]
patch w/ layout test

View in context: https://bugs.webkit.org/attachment.cgi?id=132710&action=review

> LayoutTests/editing/selection/move-by-word-visually-crash-test-css-generated-content.html:1
> +<head>

No DOCTYPE?
Comment 4 Xiaomei Ji 2012-03-20 16:22:51 PDT 
Comment on attachment 132710 [details]
patch w/ layout test

View in context: https://bugs.webkit.org/attachment.cgi?id=132710&action=review

>> LayoutTests/editing/selection/move-by-word-visually-crash-test-css-generated-content.html:1
>> +<head>
> 
> No DOCTYPE?

I will update all the tests in another patch.
Comment 5 WebKit Review Bot 2012-03-20 16:50:10 PDT 
Comment on attachment 132710 [details]
patch w/ layout test

Clearing flags on attachment: 132710

Committed r111469: <http://trac.webkit.org/changeset/111469>
Comment 6 WebKit Review Bot 2012-03-20 16:50:15 PDT 
All reviewed patches have been landed.  Closing bug.