Regression(82144): Crash in TrailingObjects::updateMidpointsForTrailingBoxes
authorAbhishek Arya <inferno@chromium.org>
Mon, 1 Aug 2011 18:03:03 +0000 (18:03 +0000)
committerAdemar de Souza Reis Jr <ademar.reis@openbossa.org>
Fri, 5 Aug 2011 20:40:21 +0000 (17:40 -0300)
commit244cf0d8aa7f831c0774c491f2c40fc6172426da
tree1d6a3fe5c58910402082cf9be2c9cbf2605ff9e2
parentc1022df9dc8bced1b5d9a40afc9ed5257e9bbc0e
Regression(82144): Crash in TrailingObjects::updateMidpointsForTrailingBoxes
https://bugs.webkit.org/show_bug.cgi?id=65137

Source/WebCore:

Fix the looping condition to prevent trailingSpaceMidpoint from becoming negative.

Reviewed by Dave Hyatt.

Test: fast/block/update-midpoints-for-trailing-boxes-crash.html

* rendering/RenderBlockLineLayout.cpp:
(WebCore::TrailingObjects::updateMidpointsForTrailingBoxes):

LayoutTests:

ASSERTION FAILED: trailingSpaceMidpoint >= 0

Reviewed by Dave Hyatt.

* fast/block/update-midpoints-for-trailing-boxes-crash-expected.txt: Added.
* fast/block/update-midpoints-for-trailing-boxes-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@92132 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/block/update-midpoints-for-trailing-boxes-crash-expected.txt [new file with mode: 0644]
LayoutTests/fast/block/update-midpoints-for-trailing-boxes-crash.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/rendering/RenderBlockLineLayout.cpp