<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[186746] branches/safari-600.1.4.17-branch</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/186746">186746</a></dd>
<dt>Author</dt> <dd>ddkilzer@apple.com</dd>
<dt>Date</dt> <dd>2015-07-12 21:07:54 -0700 (Sun, 12 Jul 2015)</dd>
</dl>
<h3>Log Message</h3>
<pre>Merge <a href="http://trac.webkit.org/projects/webkit/changeset/185572">r185572</a>. rdar://problem/21716531</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#branchessafari6001417branchLayoutTestsChangeLog">branches/safari-600.1.4.17-branch/LayoutTests/ChangeLog</a></li>
<li><a href="#branchessafari6001417branchSourceWebCoreChangeLog">branches/safari-600.1.4.17-branch/Source/WebCore/ChangeLog</a></li>
<li><a href="#branchessafari6001417branchSourceWebCorerenderingRenderInlinecpp">branches/safari-600.1.4.17-branch/Source/WebCore/rendering/RenderInline.cpp</a></li>
<li><a href="#branchessafari6001417branchSourceWebCorerenderingRootInlineBoxcpp">branches/safari-600.1.4.17-branch/Source/WebCore/rendering/RootInlineBox.cpp</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#branchessafari6001417branchLayoutTestsfastinlinecrashwhenchildrendererisremovedandlinestayscleanexpectedtxt">branches/safari-600.1.4.17-branch/LayoutTests/fast/inline/crash-when-child-renderer-is-removed-and-line-stays-clean-expected.txt</a></li>
<li><a href="#branchessafari6001417branchLayoutTestsfastinlinecrashwhenchildrendererisremovedandlinestayscleanhtml">branches/safari-600.1.4.17-branch/LayoutTests/fast/inline/crash-when-child-renderer-is-removed-and-line-stays-clean.html</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="branchessafari6001417branchLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: branches/safari-600.1.4.17-branch/LayoutTests/ChangeLog (186745 => 186746)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1.4.17-branch/LayoutTests/ChangeLog 2015-07-13 02:16:17 UTC (rev 186745)
+++ branches/safari-600.1.4.17-branch/LayoutTests/ChangeLog 2015-07-13 04:07:54 UTC (rev 186746)
</span><span class="lines">@@ -1,5 +1,24 @@
</span><span class="cx"> 2015-07-12 David Kilzer <ddkilzer@apple.com>
</span><span class="cx">
</span><ins>+ Merge r185572. rdar://problem/21716531
+
+ 2015-06-15 Zalan Bujtas <zalan@apple.com>
+
+ RootInlineBox::m_lineBreakObj becomes invalid when a child renderer is removed and the line does not get marked dirty.
+ https://bugs.webkit.org/show_bug.cgi?id=145988
+ rdar://problem/20959137
+
+ Reviewed by David Hyatt.
+
+ This patch ensures that we find the right first inline box so that we can dirty the
+ the appropriate line boxes.
+ With marking the right line boxes dirty, now we can update RootInlineBox::m_lineBreakObj at the next layout.
+
+ * fast/inline/crash-when-child-renderer-is-removed-and-line-stays-clean-expected.txt: Added.
+ * fast/inline/crash-when-child-renderer-is-removed-and-line-stays-clean.html: Added.
+
+2015-07-12 David Kilzer <ddkilzer@apple.com>
+
</ins><span class="cx"> Merge r184434, and a small part of r173173. rdar://problem/21716506
</span><span class="cx">
</span><span class="cx"> * http/tests/security/canvas-remote-read-data-url-image-redirect-expected.txt:
</span></span></pre></div>
<a id="branchessafari6001417branchLayoutTestsfastinlinecrashwhenchildrendererisremovedandlinestayscleanexpectedtxt"></a>
<div class="addfile"><h4>Added: branches/safari-600.1.4.17-branch/LayoutTests/fast/inline/crash-when-child-renderer-is-removed-and-line-stays-clean-expected.txt (0 => 186746)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1.4.17-branch/LayoutTests/fast/inline/crash-when-child-renderer-is-removed-and-line-stays-clean-expected.txt (rev 0)
+++ branches/safari-600.1.4.17-branch/LayoutTests/fast/inline/crash-when-child-renderer-is-removed-and-line-stays-clean-expected.txt 2015-07-13 04:07:54 UTC (rev 186746)
</span><span class="lines">@@ -0,0 +1,4 @@
</span><ins>+Pass if no crash or assert in Debug. bar
+
+
+
</ins></span></pre></div>
<a id="branchessafari6001417branchLayoutTestsfastinlinecrashwhenchildrendererisremovedandlinestayscleanhtml"></a>
<div class="addfile"><h4>Added: branches/safari-600.1.4.17-branch/LayoutTests/fast/inline/crash-when-child-renderer-is-removed-and-line-stays-clean.html (0 => 186746)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1.4.17-branch/LayoutTests/fast/inline/crash-when-child-renderer-is-removed-and-line-stays-clean.html (rev 0)
+++ branches/safari-600.1.4.17-branch/LayoutTests/fast/inline/crash-when-child-renderer-is-removed-and-line-stays-clean.html 2015-07-13 04:07:54 UTC (rev 186746)
</span><span class="lines">@@ -0,0 +1,22 @@
</span><ins>+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+window.onload = function()
+{
+ document.body.offsetTop;
+ b.lastChild.parentNode.removeChild(b.lastChild);
+ document.body.offsetTop;
+ a.firstChild.parentNode.removeChild(a.firstChild);
+}
+</script>
+<body>
+<div id="a">foo</div><div></div>
+<div>Pass if no crash or assert in Debug.
+<output>
+<o&#x0195;tput>bar</output>
+<span id="b">
+<span>
+<div style="display:inline-block"></div>
+<br><br><br>
+</span>
+</body>
</ins></span></pre></div>
<a id="branchessafari6001417branchSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: branches/safari-600.1.4.17-branch/Source/WebCore/ChangeLog (186745 => 186746)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1.4.17-branch/Source/WebCore/ChangeLog 2015-07-13 02:16:17 UTC (rev 186745)
+++ branches/safari-600.1.4.17-branch/Source/WebCore/ChangeLog 2015-07-13 04:07:54 UTC (rev 186746)
</span><span class="lines">@@ -1,5 +1,29 @@
</span><span class="cx"> 2015-07-12 David Kilzer <ddkilzer@apple.com>
</span><span class="cx">
</span><ins>+ Merge r185572. rdar://problem/21716531
+
+ 2015-06-15 Zalan Bujtas <zalan@apple.com>
+
+ RootInlineBox::m_lineBreakObj becomes invalid when a child renderer is removed and the line does not get marked dirty.
+ https://bugs.webkit.org/show_bug.cgi?id=145988
+ rdar://problem/20959137
+
+ Reviewed by David Hyatt.
+
+ This patch ensures that we find the right first inline box so that we can dirty the
+ the appropriate line boxes.
+ With marking the right line boxes dirty, now we can update RootInlineBox::m_lineBreakObj at the next layout.
+
+ Test: fast/inline/crash-when-child-renderer-is-removed-and-line-stays-clean.html
+
+ * rendering/RenderInline.cpp:
+ (WebCore::RenderInline::culledInlineFirstLineBox):
+ (WebCore::RenderInline::culledInlineLastLineBox):
+ * rendering/RootInlineBox.cpp:
+ (WebCore::RootInlineBox::setLineBreakInfo): Deleted. Remove misleading assert and comment.
+
+2015-07-12 David Kilzer <ddkilzer@apple.com>
+
</ins><span class="cx"> Merge r184434, and a small part of r173173. rdar://problem/21716506
</span><span class="cx">
</span><span class="cx"> 2015-05-15 Antti Koivisto <antti@apple.com>
</span></span></pre></div>
<a id="branchessafari6001417branchSourceWebCorerenderingRenderInlinecpp"></a>
<div class="modfile"><h4>Modified: branches/safari-600.1.4.17-branch/Source/WebCore/rendering/RenderInline.cpp (186745 => 186746)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1.4.17-branch/Source/WebCore/rendering/RenderInline.cpp 2015-07-13 02:16:17 UTC (rev 186745)
+++ branches/safari-600.1.4.17-branch/Source/WebCore/rendering/RenderInline.cpp 2015-07-13 04:07:54 UTC (rev 186746)
</span><span class="lines">@@ -926,9 +926,11 @@
</span><span class="cx">
</span><span class="cx"> // We want to get the margin box in the inline direction, and then use our font ascent/descent in the block
</span><span class="cx"> // direction (aligned to the root box's baseline).
</span><del>- if (curr->isBox())
- return toRenderBox(curr)->inlineBoxWrapper();
- if (curr->isLineBreak()) {
</del><ins>+ if (curr->isBox()) {
+ const RenderBox* renderBox = toRenderBox(curr);
+ if (renderBox->inlineBoxWrapper())
+ return renderBox->inlineBoxWrapper();
+ } else if (curr->isLineBreak()) {
</ins><span class="cx"> RenderLineBreak* renderBR = toRenderLineBreak(curr);
</span><span class="cx"> if (renderBR->inlineBoxWrapper())
</span><span class="cx"> return renderBR->inlineBoxWrapper();
</span><span class="lines">@@ -954,9 +956,11 @@
</span><span class="cx">
</span><span class="cx"> // We want to get the margin box in the inline direction, and then use our font ascent/descent in the block
</span><span class="cx"> // direction (aligned to the root box's baseline).
</span><del>- if (curr->isBox())
- return toRenderBox(curr)->inlineBoxWrapper();
- if (curr->isLineBreak()) {
</del><ins>+ if (curr->isBox()) {
+ const RenderBox* renderBox = toRenderBox(curr);
+ if (renderBox->inlineBoxWrapper())
+ return renderBox->inlineBoxWrapper();
+ } else if (curr->isLineBreak()) {
</ins><span class="cx"> RenderLineBreak* renderBR = toRenderLineBreak(curr);
</span><span class="cx"> if (renderBR->inlineBoxWrapper())
</span><span class="cx"> return renderBR->inlineBoxWrapper();
</span></span></pre></div>
<a id="branchessafari6001417branchSourceWebCorerenderingRootInlineBoxcpp"></a>
<div class="modfile"><h4>Modified: branches/safari-600.1.4.17-branch/Source/WebCore/rendering/RootInlineBox.cpp (186745 => 186746)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-600.1.4.17-branch/Source/WebCore/rendering/RootInlineBox.cpp 2015-07-13 02:16:17 UTC (rev 186745)
+++ branches/safari-600.1.4.17-branch/Source/WebCore/rendering/RootInlineBox.cpp 2015-07-13 04:07:54 UTC (rev 186746)
</span><span class="lines">@@ -796,13 +796,6 @@
</span><span class="cx">
</span><span class="cx"> void RootInlineBox::setLineBreakInfo(RenderObject* obj, unsigned breakPos, const BidiStatus& status)
</span><span class="cx"> {
</span><del>- // When setting lineBreakObj, the RenderObject must not be a RenderInline
- // with no line boxes, otherwise all sorts of invariants are broken later.
- // This has security implications because if the RenderObject does not
- // point to at least one line box, then that RenderInline can be deleted
- // later without resetting the lineBreakObj, leading to use-after-free.
- ASSERT_WITH_SECURITY_IMPLICATION(!obj || obj->isText() || !(obj->isRenderInline() && obj->isBox() && !toRenderBox(obj)->inlineBoxWrapper()));
-
</del><span class="cx"> m_lineBreakObj = obj;
</span><span class="cx"> m_lineBreakPos = breakPos;
</span><span class="cx"> m_lineBreakBidiStatusEor = status.eor;
</span></span></pre>
</div>
</div>
</body>
</html>