diff options
| author | Steve Block <steveblock@google.com> | 2010-08-06 18:59:56 -0700 |
|---|---|---|
| committer | Android Git Automerger <android-git-automerger@android.com> | 2010-08-06 18:59:56 -0700 |
| commit | 7c8c1ab35fc21fce4eaa3455d70b040a845b7eb6 (patch) | |
| tree | 983991cca67a0b795eb7e57544ff79e9183c1a43 | |
| parent | 373399bd97b28edc9ee0b6fafdce24cd3becc42c (diff) | |
| parent | e9ee2d864ded6c57c02ebc2ff6e41a0711d099d3 (diff) | |
| download | external_webkit-7c8c1ab35fc21fce4eaa3455d70b040a845b7eb6.zip external_webkit-7c8c1ab35fc21fce4eaa3455d70b040a845b7eb6.tar.gz external_webkit-7c8c1ab35fc21fce4eaa3455d70b040a845b7eb6.tar.bz2 | |
am e9ee2d86: am a4279478: Cherry-pick WebKit change 61921 to fix exploitable memory corruption in RenderBoxModelObject
Merge commit 'e9ee2d864ded6c57c02ebc2ff6e41a0711d099d3' into gingerbread-plus-aosp
* commit 'e9ee2d864ded6c57c02ebc2ff6e41a0711d099d3':
Cherry-pick WebKit change 61921 to fix exploitable memory corruption in RenderBoxModelObject
| -rw-r--r-- | WebCore/platform/text/BidiResolver.h | 67 |
1 files changed, 39 insertions, 28 deletions
diff --git a/WebCore/platform/text/BidiResolver.h b/WebCore/platform/text/BidiResolver.h index 286cdcd..a99fd01 100644 --- a/WebCore/platform/text/BidiResolver.h +++ b/WebCore/platform/text/BidiResolver.h @@ -806,35 +806,33 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, boo break; } - if (pastEnd) { - if (eor == current) { - if (!reachedEndOfLine) { - eor = endOfLine; - switch (m_status.eor) { - case LeftToRight: - case RightToLeft: - case ArabicNumber: - m_direction = m_status.eor; - break; - case EuropeanNumber: - m_direction = m_status.lastStrong == LeftToRight ? LeftToRight : EuropeanNumber; - break; - default: - ASSERT(false); - } - appendRun(); + if (pastEnd && eor == current) { + if (!reachedEndOfLine) { + eor = endOfLine; + switch (m_status.eor) { + case LeftToRight: + case RightToLeft: + case ArabicNumber: + m_direction = m_status.eor; + break; + case EuropeanNumber: + m_direction = m_status.lastStrong == LeftToRight ? LeftToRight : EuropeanNumber; + break; + default: + ASSERT(false); } - current = end; - m_status = stateAtEnd.m_status; - sor = stateAtEnd.sor; - eor = stateAtEnd.eor; - last = stateAtEnd.last; - reachedEndOfLine = stateAtEnd.reachedEndOfLine; - lastBeforeET = stateAtEnd.lastBeforeET; - emptyRun = stateAtEnd.emptyRun; - m_direction = OtherNeutral; - break; + appendRun(); } + current = end; + m_status = stateAtEnd.m_status; + sor = stateAtEnd.sor; + eor = stateAtEnd.eor; + last = stateAtEnd.last; + reachedEndOfLine = stateAtEnd.reachedEndOfLine; + lastBeforeET = stateAtEnd.lastBeforeET; + emptyRun = stateAtEnd.emptyRun; + m_direction = OtherNeutral; + break; } // set m_status.last as needed. @@ -887,8 +885,21 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, boo } increment(); - if (!m_currentExplicitEmbeddingSequence.isEmpty()) + if (!m_currentExplicitEmbeddingSequence.isEmpty()) { commitExplicitEmbedding(); + if (pastEnd) { + current = end; + m_status = stateAtEnd.m_status; + sor = stateAtEnd.sor; + eor = stateAtEnd.eor; + last = stateAtEnd.last; + reachedEndOfLine = stateAtEnd.reachedEndOfLine; + lastBeforeET = stateAtEnd.lastBeforeET; + emptyRun = stateAtEnd.emptyRun; + m_direction = OtherNeutral; + break; + } + } if (emptyRun && (dirCurrent == RightToLeftEmbedding || dirCurrent == LeftToRightEmbedding |