diff options
| author | Steve Block <steveblock@google.com> | 2010-08-06 18:55:12 -0700 |
|---|---|---|
| committer | Android Git Automerger <android-git-automerger@android.com> | 2010-08-06 18:55:12 -0700 |
| commit | e9ee2d864ded6c57c02ebc2ff6e41a0711d099d3 (patch) | |
| tree | 98d0231099bb87c17dcd5a1195f708a7c93ea448 /WebCore/platform | |
| parent | 7162fe0e3c5886b6c35f42c5cd9d9e83aa3785cf (diff) | |
| parent | a42794783dfec7f142845611dc0f20bfe2657c49 (diff) | |
| download | external_webkit-e9ee2d864ded6c57c02ebc2ff6e41a0711d099d3.zip external_webkit-e9ee2d864ded6c57c02ebc2ff6e41a0711d099d3.tar.gz external_webkit-e9ee2d864ded6c57c02ebc2ff6e41a0711d099d3.tar.bz2 | |
am a4279478: Cherry-pick WebKit change 61921 to fix exploitable memory corruption in RenderBoxModelObject
Merge commit 'a42794783dfec7f142845611dc0f20bfe2657c49' into gingerbread
* commit 'a42794783dfec7f142845611dc0f20bfe2657c49':
Cherry-pick WebKit change 61921 to fix exploitable memory corruption in RenderBoxModelObject
Diffstat (limited to 'WebCore/platform')
| -rw-r--r-- | WebCore/platform/text/BidiResolver.h | 67 |
1 files changed, 39 insertions, 28 deletions
diff --git a/WebCore/platform/text/BidiResolver.h b/WebCore/platform/text/BidiResolver.h index 286cdcd..a99fd01 100644 --- a/WebCore/platform/text/BidiResolver.h +++ b/WebCore/platform/text/BidiResolver.h @@ -806,35 +806,33 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, boo break; } - if (pastEnd) { - if (eor == current) { - if (!reachedEndOfLine) { - eor = endOfLine; - switch (m_status.eor) { - case LeftToRight: - case RightToLeft: - case ArabicNumber: - m_direction = m_status.eor; - break; - case EuropeanNumber: - m_direction = m_status.lastStrong == LeftToRight ? LeftToRight : EuropeanNumber; - break; - default: - ASSERT(false); - } - appendRun(); + if (pastEnd && eor == current) { + if (!reachedEndOfLine) { + eor = endOfLine; + switch (m_status.eor) { + case LeftToRight: + case RightToLeft: + case ArabicNumber: + m_direction = m_status.eor; + break; + case EuropeanNumber: + m_direction = m_status.lastStrong == LeftToRight ? LeftToRight : EuropeanNumber; + break; + default: + ASSERT(false); } - current = end; - m_status = stateAtEnd.m_status; - sor = stateAtEnd.sor; - eor = stateAtEnd.eor; - last = stateAtEnd.last; - reachedEndOfLine = stateAtEnd.reachedEndOfLine; - lastBeforeET = stateAtEnd.lastBeforeET; - emptyRun = stateAtEnd.emptyRun; - m_direction = OtherNeutral; - break; + appendRun(); } + current = end; + m_status = stateAtEnd.m_status; + sor = stateAtEnd.sor; + eor = stateAtEnd.eor; + last = stateAtEnd.last; + reachedEndOfLine = stateAtEnd.reachedEndOfLine; + lastBeforeET = stateAtEnd.lastBeforeET; + emptyRun = stateAtEnd.emptyRun; + m_direction = OtherNeutral; + break; } // set m_status.last as needed. @@ -887,8 +885,21 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, boo } increment(); - if (!m_currentExplicitEmbeddingSequence.isEmpty()) + if (!m_currentExplicitEmbeddingSequence.isEmpty()) { commitExplicitEmbedding(); + if (pastEnd) { + current = end; + m_status = stateAtEnd.m_status; + sor = stateAtEnd.sor; + eor = stateAtEnd.eor; + last = stateAtEnd.last; + reachedEndOfLine = stateAtEnd.reachedEndOfLine; + lastBeforeET = stateAtEnd.lastBeforeET; + emptyRun = stateAtEnd.emptyRun; + m_direction = OtherNeutral; + break; + } + } if (emptyRun && (dirCurrent == RightToLeftEmbedding || dirCurrent == LeftToRightEmbedding |