Skip to content

GitLab

T
tangled
Commit 4a9339fb authored by Koji Ishii's avatar Koji Ishii Committed by Commit Bot
Browse files
Options

Fix NGLineBreaker::RewindOverflow crash 

This patch is a re-fix of r819722 <crrev.com/c/2489730>.

It turned out that |NGLineBreaker| hangs the attached test
case before r819722, and crashes after. This is because
|Rewind| may fail if the line has floats, and in that case,
the current item is not a text item.

This patch changes it to just setting the state to |kTrailing|
and return, so that, if |Rewind| succeeds, |BreakLine| will
call |HandleText|, which will call |HandleTrailingSpaces| when
the text item starts with spaces.

When |Rewind| fails, |BreakLine| can handle non-text items too.

Bug: 1141384
Change-Id: I96e428d2c9ff50b3685c2a83eafdcea509749594
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2492700Reviewed-by: default avatarYoshifumi Inoue <yosin@chromium.org>
Commit-Queue: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#820154}
parent dbc1c5e8
Hide whitespace changes
Inline Side-by-side
Showing with 31 additions and 14 deletions
third_party/blink/renderer/core/layout/ng/inline/ng_line_breaker.cc
View file @ 4a9339fb
......@@ -1155,12 +1155,6 @@ void NGLineBreaker::UpdateShapeResult(const NGLineInfo& line_info,
item_result->inline_size = item_result->shape_result->SnappedWidth();
}
void NGLineBreaker::HandleTrailingSpaces(NGLineInfo* line_info) {
const Vector<NGInlineItem>& items = Items();
if (item_index_ < items.size())
HandleTrailingSpaces(items[item_index_], line_info);
}
inline void NGLineBreaker::HandleTrailingSpaces(const NGInlineItem& item,
NGLineInfo* line_info) {
const ShapeResult* shape_result = item.TextShapeResult();
......@@ -2083,14 +2077,12 @@ void NGLineBreaker::RewindOverflow(unsigned new_end, NGLineInfo* line_info) {
continue;
}
// If this item starts with spaces followed by non-space characters,
// rewind to before this item. |HandleText()| will include the spaces
// and break there.
// TODO: optimize more?
// the line should break after the spaces. Rewind to before this item.
Rewind(index, line_info);
HandleTrailingSpaces(line_info);
#if DCHECK_IS_ON()
item_results.back().CheckConsistency(false);
#endif
// Now we want to |HandleTrailingSpaces| in this |item|, but |Rewind|
// may have failed when we have floats. Set the |state_| to
// |kTrailing| and let the next |HandleText| to handle this.
state_ = LineBreakState::kTrailing;
return;
}
}
......
third_party/blink/renderer/core/layout/ng/inline/ng_line_breaker.h
View file @ 4a9339fb
......@@ -157,7 +157,6 @@ class CORE_EXPORT NGLineBreaker {
unsigned start,
unsigned end);
void HandleTrailingSpaces(NGLineInfo*);
void HandleTrailingSpaces(const NGInlineItem&, NGLineInfo*);
void HandleTrailingSpaces(const NGInlineItem&,
const ShapeResult*,
......
third_party/blink/web_tests/external/wpt/css/css-text/crashtests/line-break-float-crash.html 0 → 100644
View file @ 4a9339fb
<!DOCTYPE html>
<link rel="help" href="https://drafts.csswg.org/css-text-3">
<link rel="author" title="Koji Ishii" href="mailto:kojii@chromium.org">
<style>
#container {
font-size: 100px;
width: 33554432px;
}
atomic {
display: inline-block;
width: 1ch;
}
left {
float: left;
width: 33554432px;
height: 10px;
}
</style>
<body>
<div id="container">
<atomic></atomic>
0
<left></left>
<span dir="ltr"><atomic></atomic></span>
</div>
</body>
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment