Skip to content

GitLab

T
tangled
Commit dc902f20 authored by David Grogan's avatar David Grogan Committed by Commit Bot
Browse files
Options

[css-tables] Fix crash in column collapsing 

An off-by-one error could leave an empty spot for a cell at the end of
each row in a section's grid_. The 14 existing callers of
section->NumCols(row) all had null checks that effectively ignored
empty cells via one of the methods below.

section->OriginatingCellAt(r,c)
section->GridCellAt(r,c).PrimaryCell()
section->GridCellAt(r,c).HasCells()

I suspect the column collapsing code that exposed this is also buggy
but I'll follow that up in a future patch.

Bug: 761192
Change-Id: Ifac74a0189ad50f1bcfc44343fd644d3baa12c44
Reviewed-on: https://chromium-review.googlesource.com/688752Reviewed-by: default avatarMorten Stenshorne <mstensho@opera.com>
Commit-Queue: David Grogan <dgrogan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#505191}
parent 748d6b12
Hide whitespace changes
Inline Side-by-side
Showing with 20 additions and 1 deletion
third_party/WebKit/LayoutTests/fast/table/split-effective-column-visibility-collapse-crash.html 0 → 100644
View file @ dc902f20
<!doctype html>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<table>
<colgroup></colgroup>
<colgroup style="visibility:collapse"></colgroup>
<tr>
<td colspan=5></td>
</tr>
<tr>
<td></td>
</tr>
</table>
<script>
test(() => {
}, "No crash or assertion failure. crbug.com/761192");
</script>
third_party/WebKit/Source/core/layout/LayoutTableSection.cpp
View file @ dc902f20
......@@ -1726,7 +1726,7 @@ void LayoutTableSection::SplitEffectiveColumn(unsigned pos, unsigned first) {
c_col_++;
for (unsigned row = 0; row < grid_.size(); ++row) {
auto& grid_cells = grid_[row].grid_cells;
EnsureCols(row, pos + 2);
EnsureCols(row, pos + 1);
grid_cells.insert(pos + 1, TableGridCell());
if (grid_cells[pos].HasCells()) {
grid_cells[pos + 1].Cells().AppendVector(grid_cells[pos].Cells());
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment