projects / profile / ivi / webkit-efl.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: a328a18)
MathML crash in WebCore::Node::previousSibling()
authorcommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 13 Mar 2012 23:45:53 +0000 (23:45 +0000)
committercommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 13 Mar 2012 23:45:53 +0000 (23:45 +0000)
https://bugs.webkit.org/show_bug.cgi?id=80773

Patch by Jacky Jiang <zhajiang@rim.com> on 2012-03-13
Reviewed by Julien Chaffraix.

Source/WebCore:

When adding child for msub render, if the child is mtr or mtd render,
we will creat an anonymous render as the container. As the anonymous
render's node is 0, accessing it directly can cause crash.
We should do a valid check of the node before using. In addition to
that, for msub, attach the anonymous render and it's children to render
tree. For msubsup, such kind of situation should never happen based on
the current codebase.

Test: mathml/msub-anonymous-child-render-crash.html

* rendering/mathml/RenderMathMLSubSup.cpp:
(WebCore::RenderMathMLSubSup::addChild):

LayoutTests:

* mathml/msub-anonymous-child-render-crash-expected.txt: Added.
* mathml/msub-anonymous-child-render-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@110640 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog patch | blob | history
LayoutTests/mathml/msub-anonymous-child-render-crash-expected.txt [new file with mode: 0644] patch | blob
LayoutTests/mathml/msub-anonymous-child-render-crash.html [new file with mode: 0644] patch | blob
Source/WebCore/ChangeLog patch | blob | history
Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp patch | blob | history

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index bbda873..345aa59 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2012-03-13  Jacky Jiang  <zhajiang@rim.com>
+
+        MathML crash in WebCore::Node::previousSibling()
+        https://bugs.webkit.org/show_bug.cgi?id=80773
+
+        Reviewed by Julien Chaffraix.
+
+        * mathml/msub-anonymous-child-render-crash-expected.txt: Added.
+        * mathml/msub-anonymous-child-render-crash.html: Added.
+
 2012-03-13  Mihnea Ovidenie  <mihnea@adobe.com>
 
         [CSSRegions]NamedFlow::getRegionsByContentNode should not return a live NodeList
diff --git a/LayoutTests/mathml/msub-anonymous-child-render-crash-expected.txt b/LayoutTests/mathml/msub-anonymous-child-render-crash-expected.txt
new file mode 100644 (file)
index 0000000..05cc6cb
--- /dev/null
+++ b/LayoutTests/mathml/msub-anonymous-child-render-crash-expected.txt
@@ -0,0 +1,7 @@
+This test passes if it does not crash.
+
+X
+3
+Y3X
+3
+2Y32
diff --git a/LayoutTests/mathml/msub-anonymous-child-render-crash.html b/LayoutTests/mathml/msub-anonymous-child-render-crash.html
new file mode 100644 (file)
index 0000000..a9affe5
--- /dev/null
+++ b/LayoutTests/mathml/msub-anonymous-child-render-crash.html
@@ -0,0 +1,29 @@
+<html>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+<body>
+<p>This test passes if it does not crash.</p>
+<math xmlns="http://www.w3.org/1998/Math/MathML">
+    <msub>
+        <mi>X</mi>
+        <mtr>3</mtr>
+    </msub>
+    <msub>
+        <mi>Y</mi>
+        <mtd>3</mtd>
+    </msub>
+    <msubsup>
+        <mi>X</mi>
+        <mtr>3</mtr>
+        <mn>2</mn>
+    </msubsup>
+    <msubsup>
+        <mi>Y</mi>
+        <mtd>3</mtd>
+        <mn>2</mn>
+    </msubsup>
+</math>
+</body>
+</html>
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 83b8803..1d289d7 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,23 @@
+2012-03-13  Jacky Jiang  <zhajiang@rim.com>
+
+        MathML crash in WebCore::Node::previousSibling()
+        https://bugs.webkit.org/show_bug.cgi?id=80773
+
+        Reviewed by Julien Chaffraix.
+
+        When adding child for msub render, if the child is mtr or mtd render,
+        we will creat an anonymous render as the container. As the anonymous
+        render's node is 0, accessing it directly can cause crash.
+        We should do a valid check of the node before using. In addition to
+        that, for msub, attach the anonymous render and it's children to render
+        tree. For msubsup, such kind of situation should never happen based on
+        the current codebase.
+
+        Test: mathml/msub-anonymous-child-render-crash.html
+
+        * rendering/mathml/RenderMathMLSubSup.cpp:
+        (WebCore::RenderMathMLSubSup::addChild):
+
 2012-03-13  Mihnea Ovidenie  <mihnea@adobe.com>
 
         [CSSRegions]NamedFlow::getRegionsByContentNode should not return a live NodeList
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp b/Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp
index 84928d4..c71cbd9 100644 (file)
--- a/Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp
@@ -68,7 +68,7 @@ void RenderMathMLSubSup::addChild(RenderObject* child, RenderObject* beforeChild
     // Note: The RenderMathMLBlock only allows element children to be added.
     Element* childElement = toElement(child->node());
 
-    if (!childElement->previousElementSibling()) {
+    if (childElement && !childElement->previousElementSibling()) {
         // Position 1 is always the base of the msub/msup/msubsup.
         RenderMathMLBlock* wrapper = new (renderArena()) RenderMathMLBlock(node());
         RefPtr<RenderStyle> wrapperStyle = RenderStyle::create();
@@ -95,6 +95,10 @@ void RenderMathMLSubSup::addChild(RenderObject* child, RenderObject* beforeChild
         }
     } else {
         if (m_kind == SubSup) {
+            ASSERT(childElement);
+            if (!childElement)
+                return;
+
             RenderBlock* script = new (renderArena()) RenderMathMLBlock(node());
             RefPtr<RenderStyle> scriptStyle = RenderStyle::create();
             scriptStyle->inheritFrom(m_scripts->style());
Domain: Web Framework / Uncategorized;