Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(937)

Unified Diff: Source/core/paint/InlineTextBoxPainter.cpp

Issue 842913002: RenderCounter::updateCounter should trigger a relayout. (Closed) Base URL: svn://svn.chromium.org/blink/trunk
Patch Set: Created 5 years, 11 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: Source/core/paint/InlineTextBoxPainter.cpp
diff --git a/Source/core/paint/InlineTextBoxPainter.cpp b/Source/core/paint/InlineTextBoxPainter.cpp
index 46aade4bc2ae482e2eb364587141fe841589b723..80a801ab7cba1a72ec3ad2fae4829468a0a2c73d 100644
--- a/Source/core/paint/InlineTextBoxPainter.cpp
+++ b/Source/core/paint/InlineTextBoxPainter.cpp
@@ -149,6 +149,7 @@ void InlineTextBoxPainter::paint(const PaintInfo& paintInfo, const LayoutPoint&
StringView string;
if (!combinedText) {
string = m_inlineTextBox.renderer().text().createView();
+ ASSERT(m_inlineTextBox.start() + length <= string.length());
if (static_cast<unsigned>(length) != string.length() || m_inlineTextBox.start())
string.narrow(m_inlineTextBox.start(), length);
maximumLength = m_inlineTextBox.renderer().textLength() - m_inlineTextBox.start();
« no previous file with comments | « LayoutTests/fast/css/counters/stale-inline-box-crash-expected.txt ('k') | Source/core/rendering/RenderCounter.cpp » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698