diff options
| author | Ryosuke Niwa <rniwa@webkit.org> | 2013-11-06 08:05:09 +0000 |
|---|---|---|
| committer | Konstantin Tokarev <annulen@yandex.ru> | 2016-02-04 11:56:42 +0000 |
| commit | c895e640860b54b7f9c2be5e1f19d2a3fcee2aeb (patch) | |
| tree | 2e0bd1e4263d4be056a0fb7fec52c5fcd20223e9 /Source/WebCore | |
| parent | 999ff247a5a0ca31ba21d24933789541ca790fce (diff) | |
| download | qtwebkit-c895e640860b54b7f9c2be5e1f19d2a3fcee2aeb.tar.gz | |
Assertion failure end < m_runCount in WebCore::BidiRunList<WebCore::BidiRun>::reverseRuns
https://bugs.webkit.org/show_bug.cgi?id=123863
Reviewed by Andreas Kling.
Source/WebCore:
Merge https://chromium.googlesource.com/chromium/blink/+/cbaa92c763a37d89eeabd01658e522219299290c
Test: fast/text/bidi-reverse-runs-crash.html
* platform/text/BidiResolver.h:
(WebCore::BidiResolver<Iterator, Run>::createBidiRunsForLine): Don't reverse the runs if there's
nothing to be reversed.
LayoutTests:
* fast/text/bidi-reverse-runs-crash-expected.txt: Added.
* fast/text/bidi-reverse-runs-crash.html: Added.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158729 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Change-Id: I6bf0902444acf98db29c3cfa2cd3535e1a0c1bef
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@theqtcompany.com>
Diffstat (limited to 'Source/WebCore')
| -rw-r--r-- | Source/WebCore/platform/text/BidiResolver.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/Source/WebCore/platform/text/BidiResolver.h b/Source/WebCore/platform/text/BidiResolver.h index e0649fcb4..d970eaa4d 100644 --- a/Source/WebCore/platform/text/BidiResolver.h +++ b/Source/WebCore/platform/text/BidiResolver.h @@ -546,7 +546,7 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis m_direction = override == VisualLeftToRightOverride ? LeftToRight : RightToLeft; appendRun(); m_runs.setLogicallyLastRun(m_runs.lastRun()); - if (override == VisualRightToLeftOverride) + if (override == VisualRightToLeftOverride && m_runs.runCount()) m_runs.reverseRuns(0, m_runs.runCount() - 1); return; } |