Chromium Code Reviews
Help | Chromium Project | Gerrit Changes | Sign in
(35)

Issue 10970020: Merge 129144 - Prevent reading stale data from InlineTextBoxes (Closed)

Created:
8 years, 5 months ago by leviw_travelin_and_unemployed
Modified:
8 years, 5 months ago
CC:
chromium-reviews
Base URL:
http://svn.webkit.org/repository/webkit/branches/chromium/1229/
Visibility:
Public.

Description

Merge 129144 - Prevent reading stale data from InlineTextBoxes https://bugs.webkit.org/show_bug.cgi?id=94750 Reviewed by Eric Seidel. Text from dirty InlineTextBoxes should never be read or used. This change enforces this design goal by forcefully zero-ing out the start and length of InlineTextBoxes when they're being marked dirty. It also adds asserts to accessors for those members. This change involves making markDirty virtual. Running the line-layout performance test as well as profiling resizing the html5 spec showed negligable impact with this change. No new tests as this doesn't change any proper behavior. * rendering/InlineBox.h: (WebCore::InlineBox::markDirty): Making virtual to allow InlineTextBox to overload and zero out its start and length. * rendering/InlineTextBox.cpp: (WebCore::InlineTextBox::markDirty): Zeroing out start and length when we mark the box dirty. * rendering/InlineTextBox.h: (WebCore::InlineTextBox::start): Adding an assert when we hit this case. (WebCore::InlineTextBox::end): Ditto. (WebCore::InlineTextBox::len): Ditto. (WebCore::InlineTextBox::offsetRun): Ditto. TBR=leviw@chromium.org Committed: https://trac.webkit.org/changeset/129147

Patch Set 1 #

Unified diffs Side-by-side diffs Delta from patch set Stats (+16 lines, -5 lines) Patch
M Source/WebCore/rendering/InlineBox.h View 1 chunk +1 line, -1 line 0 comments Download
M Source/WebCore/rendering/InlineTextBox.h View 1 chunk +6 lines, -4 lines 0 comments Download
M Source/WebCore/rendering/InlineTextBox.cpp View 1 chunk +9 lines, -0 lines 0 comments Download

Messages

Total messages: 1 (0 generated)
leviw_travelin_and_unemployed
8 years, 5 months ago (2012-09-20 18:25:53 UTC) #1

          

Powered by Google App Engine
This is Rietveld 408576698