Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(240)

Unified Diff: Source/WebCore/rendering/RenderBlockLineLayout.cpp

Issue 9071024: Merge 102875 - Crash due to incorrect parsing of isolates (Closed) Base URL: http://svn.webkit.org/repository/webkit/branches/chromium/963/
Patch Set: Created 8 years, 12 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « Source/WebCore/rendering/InlineIterator.h ('k') | Source/WebCore/rendering/RenderBox.cpp » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: Source/WebCore/rendering/RenderBlockLineLayout.cpp
===================================================================
--- Source/WebCore/rendering/RenderBlockLineLayout.cpp (revision 103964)
+++ Source/WebCore/rendering/RenderBlockLineLayout.cpp (working copy)
@@ -949,6 +949,7 @@
// FIXME: We should pass a BidiRunList into createBidiRunsForLine instead
// of the resolver owning the runs.
ASSERT(&topResolver.runs() == &bidiRuns);
+ RenderObject* currentRoot = topResolver.position().root();
topResolver.createBidiRunsForLine(endOfLine, override, previousLineBrokeCleanly);
while (!topResolver.isolatedRuns().isEmpty()) {
@@ -956,23 +957,31 @@
BidiRun* isolatedRun = topResolver.isolatedRuns().last();
topResolver.isolatedRuns().removeLast();
+ RenderObject* startObj = isolatedRun->object();
+
// Only inlines make sense with unicode-bidi: isolate (blocks are already isolated).
- RenderInline* isolatedSpan = toRenderInline(isolatedRun->object());
+ // FIXME: Because enterIsolate is not passed a RenderObject, we have to crawl up the
+ // tree to see which parent inline is the isolate. We could change enterIsolate
+ // to take a RenderObject and do this logic there, but that would be a layering
+ // violation for BidiResolver (which knows nothing about RenderObject).
+ RenderInline* isolatedSpan = toRenderInline(containingIsolate(startObj, currentRoot));
InlineBidiResolver isolatedResolver;
isolatedResolver.setStatus(statusWithDirection(isolatedSpan->style()->direction()));
// FIXME: The fact that we have to construct an Iterator here
// currently prevents this code from moving into BidiResolver.
- RenderObject* startObj = bidiFirstSkippingEmptyInlines(isolatedSpan, &isolatedResolver);
- if (!startObj)
+ if (!bidiFirstSkippingEmptyInlines(isolatedSpan, &isolatedResolver))
continue;
- isolatedResolver.setPositionIgnoringNestedIsolates(InlineIterator(isolatedSpan, startObj, 0));
+ // The starting position is the beginning of the first run within the isolate that was identified
+ // during the earlier call to createBidiRunsForLine. This can be but is not necessarily the
+ // first run within the isolate.
+ InlineIterator iter = InlineIterator(isolatedSpan, startObj, isolatedRun->m_start);
+ isolatedResolver.setPositionIgnoringNestedIsolates(iter);
- // FIXME: isolatedEnd should probably equal end or the last char in isolatedSpan.
- InlineIterator isolatedEnd = endOfLine;
+ // We stop at the next end of line; we may re-enter this isolate in the next call to constructBidiRuns().
// FIXME: What should end and previousLineBrokeCleanly be?
// rniwa says previousLineBrokeCleanly is just a WinIE hack and could always be false here?
- isolatedResolver.createBidiRunsForLine(isolatedEnd, NoVisualOverride, previousLineBrokeCleanly);
+ isolatedResolver.createBidiRunsForLine(endOfLine, NoVisualOverride, previousLineBrokeCleanly);
// Note that we do not delete the runs from the resolver.
bidiRuns.replaceRunWithRuns(isolatedRun, isolatedResolver.runs());
Property changes on: Source\WebCore\rendering\RenderBlockLineLayout.cpp
___________________________________________________________________
Added: svn:executable
+ *
« no previous file with comments | « Source/WebCore/rendering/InlineIterator.h ('k') | Source/WebCore/rendering/RenderBox.cpp » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698