Skip to content
  • hyatt@apple.com's avatar
    https://bugs.webkit.org/show_bug.cgi?id=57221, memory corruption/crashes when positioned objects · 63a8df3f
    hyatt@apple.com authored
    occur at the end of a line.
            
    Reviewed by Simon Fraser and Darin Adler.
    
    The old code and new code for dealing with a trailing space object midpoint manipulated a raw
    array instead of the Vector. Otherwise this corruption would have been caught prior to check-in.
            
    I have patched the code to only go through the Vector and to make it handle the case that led to
    the corruption. Trailing positioned objects can occur both prior to and following the trailing space
    object's midpoint, so we have to be prepared to deal with both cases.
            
    This is already tested by fast/block/positioning/052.html, and that test now properly progresses
    like the other positioning tests did.
    
    Source/WebCore: 
    
    * rendering/RenderBlockLineLayout.cpp:
    (WebCore::RenderBlock::findNextLineBreak):
    
    LayoutTests: 
    
    * platform/mac/fast/block/positioning/052-expected.txt:
    
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@82144 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    63a8df3f