Merge 102875 - Crash due to incorrect parsing of isolates

Source/WebCore/rendering/InlineIterator.h

 /*
  * Copyright (C) 2000 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2003, 2004, 2006, 2007, 2008, 2009, 2010 Apple Inc. All right reserved.
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 404 matching lines @@
     while (object && object != iter.root()) {
         if (isIsolatedInline(object))
             count++;
         object = object->parent();
     }
     return count;
 }
 
 // FIXME: This belongs on InlineBidiResolver, except it's a template specialization
 // of BidiResolver which knows nothing about RenderObjects.
-static inline void addPlaceholderRunForIsolatedInline(InlineBidiResolver& resolver, RenderObject* isolatedInline)
+static inline void addPlaceholderRunForIsolatedInline(InlineBidiResolver& resolver, RenderObject* obj, unsigned pos)
 {
-    ASSERT(isolatedInline);
-    BidiRun* isolatedRun = new (isolatedInline->renderArena()) BidiRun(0, 0, isolatedInline, resolver.context(), resolver.dir());
+    ASSERT(obj);
+    BidiRun* isolatedRun = new (obj->renderArena()) BidiRun(pos, 0, obj, resolver.context(), resolver.dir());
     resolver.runs().addRun(isolatedRun);
     // FIXME: isolatedRuns() could be a hash of object->run and then we could cheaply
     // ASSERT here that we didn't create multiple objects for the same inline.
     resolver.isolatedRuns().append(isolatedRun);
 }
 
 class IsolateTracker {
 public:
     explicit IsolateTracker(unsigned nestedIsolateCount)
         : m_nestedIsolateCount(nestedIsolateCount)
         , m_haveAddedFakeRunForRootIsolate(false)
     {
     }
 
     void enterIsolate() { m_nestedIsolateCount++; }
     void exitIsolate()
     {
         ASSERT(m_nestedIsolateCount >= 1);
         m_nestedIsolateCount--;
         if (!inIsolate())
             m_haveAddedFakeRunForRootIsolate = false;
     }
     bool inIsolate() const { return m_nestedIsolateCount; }
 
     // We don't care if we encounter bidi directional overrides.
     void embed(WTF::Unicode::Direction, BidiEmbeddingSource) { }
 
-    void addFakeRunIfNecessary(RenderObject* obj, InlineBidiResolver& resolver)
+    void addFakeRunIfNecessary(RenderObject* obj, unsigned pos, InlineBidiResolver& resolver)
     {
-        // We only need to lookup the root isolated span and add a fake run
-        // for it once, but we'll be called for every span inside the isolated span
-        // so we just ignore the call.
+        // We only need to add a fake run for a given isolated span once during each call to createBidiRunsForLine.
+        // We'll be called for every span inside the isolated span so we just ignore subsequent calls.
         if (m_haveAddedFakeRunForRootIsolate)
             return;
         m_haveAddedFakeRunForRootIsolate = true;
-
-        // FIXME: position() could be outside the run and may be the wrong call here.
-        // If we were passed an InlineIterator instead that would have the right root().
-        RenderObject* isolatedInline = containingIsolate(obj, resolver.position().root());
-        // FIXME: Because enterIsolate is not passed a RenderObject, we have to crawl up the
-        // tree to see which parent inline is the isolate. We could change enterIsolate
-        // to take a RenderObject and do this logic there, but that would be a layering
-        // violation for BidiResolver (which knows nothing about RenderObject).
-        addPlaceholderRunForIsolatedInline(resolver, isolatedInline);
+        // obj and pos together denote a single position in the inline, from which the parsing of the isolate will start.
+        // We don't need to mark the end of the run because this is implicit: it is either endOfLine or the end of the
+        // isolate, when we call createBidiRunsForLine it will stop at whichever comes first.
+        addPlaceholderRunForIsolatedInline(resolver, obj, pos);
     }
 
 private:
     unsigned m_nestedIsolateCount;
     bool m_haveAddedFakeRunForRootIsolate;
 };
 
 template <>
 inline void InlineBidiResolver::appendRun()
 {
     if (!m_emptyRun && !m_eor.atEnd() && !m_reachedEndOfLine) {
         // Keep track of when we enter/leave "unicode-bidi: isolate" inlines.
         // Initialize our state depending on if we're starting in the middle of such an inline.
         // FIXME: Could this initialize from this->inIsolate() instead of walking up the render tree?
         IsolateTracker isolateTracker(numberOfIsolateAncestors(m_sor));
         int start = m_sor.m_pos;
         RenderObject* obj = m_sor.m_obj;
         while (obj && obj != m_eor.m_obj && obj != endOfLine.m_obj) {
             if (isolateTracker.inIsolate())
-                isolateTracker.addFakeRunIfNecessary(obj, *this);
+                isolateTracker.addFakeRunIfNecessary(obj, start, *this);
             else
                 RenderBlock::appendRunsForObject(m_runs, start, obj->length(), obj, *this);
             // FIXME: start/obj should be an InlineIterator instead of two separate variables.
             start = 0;
             obj = bidiNextSkippingEmptyInlines(m_sor.root(), obj, &isolateTracker);
         }
         if (obj) {
             unsigned pos = obj == m_eor.m_obj ? m_eor.m_pos : UINT_MAX;
             if (obj == endOfLine.m_obj && endOfLine.m_pos <= pos) {
                 m_reachedEndOfLine = true;
                 pos = endOfLine.m_pos;
             }
             // It's OK to add runs for zero-length RenderObjects, just don't make the run larger than it should be
             int end = obj->length() ? pos + 1 : 0;
             if (isolateTracker.inIsolate())
-                isolateTracker.addFakeRunIfNecessary(obj, *this);
+                isolateTracker.addFakeRunIfNecessary(obj, start, *this);
             else
                 RenderBlock::appendRunsForObject(m_runs, start, end, obj, *this);
         }
 
         m_eor.increment();
         m_sor = m_eor;
     }
 
     m_direction = WTF::Unicode::OtherNeutral;
     m_status.eor = WTF::Unicode::OtherNeutral;
 }
 
 }
 
 #endif // InlineIterator_h