Commit f4c4d71a authored by Javier Fernández García-Boente's avatar Javier Fernández García-Boente Committed by Commit Bot

Only reset trailing_collapsible_space_ structure if it has value

The crash described in the issue 1132762 was caused by our rencet change
in r811115, to ensure the trailing_collapsible_space_ structure is reset
when the associated item_result changed.

However, there was an error in the condition, so that we should ensure
we only call the 'reset()' function when the Optional has value.

Bug: 1132762, 1132811
Change-Id: I73d10c309162649e143cd66ff7702c4ac7e5eed2
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2435388
Commit-Queue: Javier Fernandez <jfernandez@igalia.com>
Reviewed-by: default avatarKoji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#811288}
parent 4e5a9782
......@@ -838,7 +838,7 @@ bool NGLineBreaker::BreakTextAtPreviousBreakOpportunity(
item_result->shape_result->SnappedWidth().ClampNegativeToZero();
item_result->can_break_after = true;
if (trailing_collapsible_space_.has_value() ||
if (trailing_collapsible_space_.has_value() &&
trailing_collapsible_space_->item_result == item_result) {
trailing_collapsible_space_.reset();
}
......
<!doctype html>
<title>CSS Text Test: Removing collapsible when overflowing cause Chrome to crash</title>
<link rel="help" href="https://crbug.com/1132762">
<style>
.test1 { word-spacing:-467616205px; }
</style>
<button>
<dfn class="test1" dir="rtl" > (y<a id=
<!DOCTYPE html>
<title>CSS Text Test: Removing collapsible space before a float element cause Chrome to crash</title>
<link rel="help" href="https://crbug.com/1131470">
<!DOCTYPE html>
<style type="text/css">
.CLASS9 {
zoom:1.3%;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment