Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(324)

Issue 2063813003: Guard against invalid glyph shaping results (Closed)

Created:
4 years, 6 months ago by pdr.
Modified:
4 years, 6 months ago
Reviewers:
CC:
chromium-reviews
Base URL:
https://chromium.googlesource.com/chromium/src.git@2704
Target Ref:
refs/pending/branch-heads/2704
Project:
chromium
Visibility:
Public.

Description

Guard against invalid glyph shaping results HarfBuzz can fail to shape all glyphs and will return a shape result shorter than the text length along with debug warnings: [ERROR:HarfBuzzShaper.cpp(375)] HarfBuzz returned empty glyph buffer after shaping. [ERROR:HarfBuzzShaper.cpp(672)] Shape result extraction failed. This patch fixes an SVG crash on the U+180E Mongolian vowel separator by ensuring CachingWordShaper::individualCharacterRanges returns a vector as long as the text run length. A DCHECK and test have been added to protect against this crash in the future. BUG=613915 Review-Url: https://codereview.chromium.org/2020863002 Cr-Commit-Position: refs/heads/master@{#396668} (cherry picked from commit 433ceaeabee98073e81d552dee947aa6983efd53) Committed: https://chromium.googlesource.com/chromium/src/+/46829e208fbf201388eec566299b859dedfab823

Patch Set 1 #

Unified diffs Side-by-side diffs Delta from patch set Stats (+23 lines, -2 lines) Patch
A third_party/WebKit/LayoutTests/svg/text/invalid-glyph-crash.html View 1 chunk +9 lines, -0 lines 0 comments Download
A third_party/WebKit/LayoutTests/svg/text/invalid-glyph-crash-expected.txt View 1 chunk +4 lines, -0 lines 0 comments Download
M third_party/WebKit/Source/platform/fonts/Font.cpp View 1 chunk +3 lines, -1 line 0 comments Download
M third_party/WebKit/Source/platform/fonts/shaping/CachingWordShaper.cpp View 1 chunk +7 lines, -1 line 0 comments Download

Messages

Total messages: 2 (1 generated)
pdr.
4 years, 6 months ago (2016-06-13 20:16:04 UTC) #2
Message was sent while issue was closed.
Committed patchset #1 (id:1) manually as
46829e208fbf201388eec566299b859dedfab823.

Powered by Google App Engine
This is Rietveld 408576698