Commit 0a6907d8 authored by yaar@chromium.org's avatar yaar@chromium.org

2010-05-19 Abhishek Arya <inferno@chromium.org>

        Reviewed by David Hyatt.

        Check that the node is a text node before doing a static cast
        to a Text class pointer.
        https://bugs.webkit.org/show_bug.cgi?id=38626    

        Test: fast/text/text-transform-nontext-node-crash.xhtml

        * rendering/RenderText.cpp:
        (WebCore::RenderText::originalText):
        * rendering/RenderTextFragment.cpp:
        (WebCore::RenderTextFragment::originalText):
        (WebCore::RenderTextFragment::previousCharacter):
2010-05-19  Abhishek Arya  <inferno@chromium.org>

        Reviewed by David Hyatt.

        Tests that text transformation applied to a non-text node
        does not result in crash.
        https://bugs.webkit.org/show_bug.cgi?id=38626        

        * fast/text/text-transform-nontext-node-crash-expected.txt: Added.
        * fast/text/text-transform-nontext-node-crash.xhtml: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59795 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent 37510bb3
2010-05-19 Abhishek Arya <inferno@chromium.org>
Reviewed by David Hyatt.
Tests that text transformation applied to a non-text node
does not result in crash.
https://bugs.webkit.org/show_bug.cgi?id=38626
* fast/text/text-transform-nontext-node-crash-expected.txt: Added.
* fast/text/text-transform-nontext-node-crash.xhtml: Added.
2010-05-19 Martin Robinson <mrobinson@igalia.com>
Not reviewed.
Tests that text transformation applied to a non-text node does not result in crash.
PASS
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script>
if (window.layoutTestController)
layoutTestController.dumpAsText();
function finish() {
document.getElementById("result").innerHTML = "PASS";
}
</script>
</head>
<body onload="finish()">
<p>Tests that text transformation applied to a non-text node does not result in crash.</p>
<div id="result"></div>
<br>
<style type="text/css">
br {
text-transform: lowercase;
}
br:first-letter {
text-transform: lowercase;
}
</style>
</br>
</body>
</html>
2010-05-19 Abhishek Arya <inferno@chromium.org>
Reviewed by David Hyatt.
Check that the node is a text node before doing a static cast
to a Text class pointer.
https://bugs.webkit.org/show_bug.cgi?id=38626
Test: fast/text/text-transform-nontext-node-crash.xhtml
* rendering/RenderText.cpp:
(WebCore::RenderText::originalText):
* rendering/RenderTextFragment.cpp:
(WebCore::RenderTextFragment::originalText):
(WebCore::RenderTextFragment::previousCharacter):
2010-05-19 Yaar Schnitman <yaar@chromium.org>
Reviewed by Eric Seidel.
......@@ -252,7 +252,7 @@ void RenderText::deleteTextBoxes()
PassRefPtr<StringImpl> RenderText::originalText() const
{
Node* e = node();
return e ? static_cast<Text*>(e)->dataImpl() : 0;
return (e && e->isTextNode()) ? static_cast<Text*>(e)->dataImpl() : 0;
}
void RenderText::absoluteRects(Vector<IntRect>& rects, int tx, int ty)
......
......@@ -47,7 +47,7 @@ RenderTextFragment::RenderTextFragment(Node* node, StringImpl* str)
PassRefPtr<StringImpl> RenderTextFragment::originalText() const
{
Node* e = node();
RefPtr<StringImpl> result = (e ? static_cast<Text*>(e)->dataImpl() : contentString());
RefPtr<StringImpl> result = ((e && e->isTextNode()) ? static_cast<Text*>(e)->dataImpl() : contentString());
if (result && (start() > 0 || start() < result->length()))
result = result->substring(start(), end());
return result.release();
......@@ -80,7 +80,7 @@ UChar RenderTextFragment::previousCharacter() const
{
if (start()) {
Node* e = node();
StringImpl* original = (e ? static_cast<Text*>(e)->dataImpl() : contentString());
StringImpl* original = ((e && e->isTextNode()) ? static_cast<Text*>(e)->dataImpl() : contentString());
if (original)
return (*original)[start() - 1];
}
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment