mirror of
https://gitlab.winehq.org/wine/wine-gecko.git
synced 2024-09-13 09:24:08 -07:00
Bug 472776. Don't accidentally clear TEXT_IN_TEXTRUN_USER_DATA after we just set it. r=smontagu
--HG-- extra : rebase_source : 1d7f12a729e471871cb6b610461f9b4eee2c64ae
This commit is contained in:
parent
19082bf736
commit
b1dd1c04eb
20
layout/generic/crashtests/472776-1.html
Normal file
20
layout/generic/crashtests/472776-1.html
Normal file
@ -0,0 +1,20 @@
|
||||
<!DOCTYPE html>
|
||||
<html>
|
||||
<head>
|
||||
<script type="text/javascript">
|
||||
|
||||
function boom()
|
||||
{
|
||||
var v = document.getElementById("v");
|
||||
v.childNodes[1].firstChild.data = "";
|
||||
document.documentElement.offsetHeight;
|
||||
v.appendChild(document.createTextNode("D"));
|
||||
v.removeChild(v.firstChild);
|
||||
}
|
||||
|
||||
</script>
|
||||
</head>
|
||||
<body onload="boom();">
|
||||
<div id="v"><span>A</span><span>یC</span></div>
|
||||
</body>
|
||||
</html>
|
@ -193,5 +193,6 @@ load 463741-1.html
|
||||
load 465651-1.html
|
||||
load 467487-1.html
|
||||
load 468207-1.html
|
||||
load 472776-1.html
|
||||
load 472950-1.html
|
||||
load 477928.html
|
||||
|
@ -1596,11 +1596,6 @@ BuildTextRunsScanner::BuildTextRunForFrames(void* aTextBuffer)
|
||||
|
||||
TextRunMappedFlow* newFlow = &userData->mMappedFlows[i];
|
||||
newFlow->mStartFrame = mappedFlow->mStartFrame;
|
||||
if (!mSkipIncompleteTextRuns) {
|
||||
// If mSkipIncompleteTextRuns is set, then we're just going to
|
||||
// throw away the userData.
|
||||
newFlow->mStartFrame->AddStateBits(TEXT_IN_TEXTRUN_USER_DATA);
|
||||
}
|
||||
newFlow->mDOMOffsetToBeforeTransformOffset = builder.GetCharCount() -
|
||||
mappedFlow->mStartFrame->GetContentOffset();
|
||||
newFlow->mContentLength = contentLength;
|
||||
@ -1950,6 +1945,9 @@ BuildTextRunsScanner::AssignTextRun(gfxTextRun* aTextRun)
|
||||
f->ClearTextRun();
|
||||
f->SetTextRun(aTextRun);
|
||||
}
|
||||
// Set this bit now; we can't set it any earlier because
|
||||
// f->ClearTextRun() might clear it out.
|
||||
startFrame->AddStateBits(TEXT_IN_TEXTRUN_USER_DATA);
|
||||
// BuildTextRunForFrames mashes together mapped flows for the same element,
|
||||
// so we do that here too.
|
||||
lastContent = startFrame->GetContent();
|
||||
|
Loading…
Reference in New Issue
Block a user