Commit 17eaa6eb authored by bdakin@apple.com's avatar bdakin@apple.com
Browse files

WebCore: Fix for https://bugs.webkit.org/show_bug.cgi?id=51355 Crash in

RenderMathMLSubSup::layout() because of null base
-and corresponding-
<rdar://problem/8712200>

Reviewed by Ada Chan.

Only use base inside if(base) block.
* mathml/RenderMathMLSubSup.cpp:
(WebCore::RenderMathMLSubSup::layout):

LayoutTests: Test for https://bugs.webkit.org/show_bug.cgi?id=51355 Crash in 
RenderMathMLSubSup::layout() because of null base
-and corresponding-
<rdar://problem/8712200>

Reviewed by Ada Chan.

* mathml/empty-msubsup-crash-expected.txt: Added.
* mathml/empty-msubsup-crash.html: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@74370 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent ca1c95ff
2010-12-20 Beth Dakin <bdakin@apple.com>
Reviewed by Ada Chan.
Test for https://bugs.webkit.org/show_bug.cgi?id=51355 Crash in
RenderMathMLSubSup::layout() because of null base
-and corresponding-
<rdar://problem/8712200>
* mathml/empty-msubsup-crash-expected.txt: Added.
* mathml/empty-msubsup-crash.html: Added.
2010-12-20 Enrica Casucci <enrica@apple.com>
Reviewed by Darin Adler.
......
This test passes if it does not crash.
<html>
<head>
<script>
if (window.layoutTestController)
layoutTestController.dumpAsText();
</script>
</head>
<body>
<p>This test passes if it does not crash.</p>
<math xmlns="http://www.w3.org/1998/Math/MathML">
<msubsup></msubsup>
</math>
</body>
</html>
2010-12-20 Beth Dakin <bdakin@apple.com>
Reviewed by Ada Chan.
Fix for https://bugs.webkit.org/show_bug.cgi?id=51355 Crash in
RenderMathMLSubSup::layout() because of null base
-and corresponding-
<rdar://problem/8712200>
Only use base inside if(base) block.
* mathml/RenderMathMLSubSup.cpp:
(WebCore::RenderMathMLSubSup::layout):
2010-12-20 Enrica Casucci <enrica@apple.com>
Reviewed by Darin Adler.
......
......@@ -152,8 +152,7 @@ void RenderMathMLSubSup::layout()
RenderBlock::layout();
if (m_kind == SubSup) {
RenderObject* base = firstChild();
if (base) {
if (RenderObject* base = firstChild()) {
int maxHeight = 0;
RenderObject* current = base->firstChild();
while (current) {
......@@ -166,9 +165,9 @@ void RenderMathMLSubSup::layout()
if (heightDiff < 0)
heightDiff = 0;
base->style()->setPaddingTop(Length(heightDiff, Fixed));
base->setNeedsLayout(true);
}
setNeedsLayout(true);
base->setNeedsLayout(true);
RenderBlock::layout();
}
}
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment