Fix crash when trying to iterate over words in an inline text box of length zero.

BUG=373885 Review URL: https://codereview.chromium.org/542553002 git-svn-id: svn://svn.chromium.org/blink/trunk@181649 bbb929c8-8fbe-4397-9dbb-9b2b20218538

Fix crash when trying to iterate over words in an inline text box of length zero.
BUG=373885 Review URL: https://codereview.chromium.org/542553002 git-svn-id: svn://svn.chromium.org/blink/trunk@181649 bbb929c8-8fbe-4397-9dbb-9b2b20218538
485faea7 · dmazzoni@chromium.org · db7ca2b0 · 485faea7 · 485faea7 · 485faea7
Commit 485faea7 authored Sep 09, 2014 by dmazzoni@chromium.org
3 changed files
--- a/third_party/WebKit/LayoutTests/accessibility/inline-text-word-boundary-causes-crash-expected.txt
+++ b/third_party/WebKit/LayoutTests/accessibility/inline-text-word-boundary-causes-crash-expected.txt
+Heading
+
+Makes sure that accessing the word boundaries of an AXStaticText object doesn't cause a crash when it has an inline text box of length zero.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+Word start for index -1: 0
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
--- a/third_party/WebKit/LayoutTests/accessibility/inline-text-word-boundary-causes-crash.html
+++ b/third_party/WebKit/LayoutTests/accessibility/inline-text-word-boundary-causes-crash.html
+<html>
+<head>
+<script src="../resources/js-test.js"></script>
+<style>
+    h1:first-letter {
+        text-transform:uppercase;
+    }
+</style>
+</head>
+<body>
+
+    <h1 id="heading">
+        heading
+    </h1>
+
+<p id="description"></p>
+<div id="console"></div>
+
+<script>
+description("Makes sure that accessing the word boundaries of an AXStaticText object doesn't cause a crash when it has an inline text box of length zero.");
+if (window.accessibilityController) {
+    var axHeading = accessibilityController.accessibleElementById('heading');
+    var axStaticText = axHeading.childAtIndex(0);
+    debug('Word start for index -1: ' + axStaticText.wordStart(-1));
+}
+</script>   
+</body>
+</html>
--- a/third_party/WebKit/Source/core/rendering/AbstractInlineTextBox.cpp
+++ b/third_party/WebKit/Source/core/rendering/AbstractInlineTextBox.cpp
@@ -132,6 +132,11 @@ void AbstractInlineTextBox::wordBoundaries(Vector<WordBoundaries>& words) const
    String text = this->text();
    int len = text.length();
    TextBreakIterator* iterator = wordBreakIterator(text, 0, len);
+
+    // FIXME: When http://crbug.com/411764 is fixed, replace this with an ASSERT.
+    if (!iterator)
+        return;
+
    int pos = iterator->first();
    while (pos >= 0 && pos < len) {
        int next = iterator->next();