WebKit Bugzilla
New
Browse
Search+
Log In
×
Sign in with GitHub
or
Remember my login
Create Account
·
Forgot Password
Forgotten password account recovery
RESOLVED FIXED
264728
Crash under TextBoxPainter<WebCore::InlineIterator::BoxModernPath>::collectDecoratingBoxesForTextBox
https://bugs.webkit.org/show_bug.cgi?id=264728
Summary
Crash under TextBoxPainter<WebCore::InlineIterator::BoxModernPath>::collectDe...
Antti Koivisto
Reported
2023-11-13 01:21:32 PST
50 WTF::CrashOnOverflow::crash() <== 50 WTF::CrashOnOverflow::overflowed() 50 WTF::Vector<WebCore::InlineDisplay::Box, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>::at(unsigned long) const 50 WTF::Vector<WebCore::InlineDisplay::Box, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>::operator[](unsigned long) const 50 WebCore::InlineIterator::BoxModernPath::box() const 50 WebCore::InlineIterator::BoxModernPath::renderer() const 50 WebCore::RenderObject const& WebCore::InlineIterator::Box::renderer() const::'lambda'(auto&)::operator()<WebCore::InlineIterator::BoxModernPath const>(auto&) const 50 decltype(std::declval<auto>()(std::declval<WebCore::InlineIterator::BoxModernPath const&>())) std::__1::__invoke[abi:v160006]<WTF::Visitor<WebCore::InlineIterator::Box::renderer() const::'lambda'(auto&)>, WebCore::InlineIterator::BoxModernPath const&>(auto&&, WebCore::InlineIterator::BoxModernPath const&) 50 decltype(auto) std::__1::__variant_detail::__visitation::__variant::__value_visitor<WTF::Visitor<WebCore::InlineIterator::Box::renderer() const::'lambda'(auto&)>>::operator()[abi:v160006]<std::__1::__variant_detail::__alt<0ul, WebCore::InlineIterator::BoxModernPath> const&>(std::__1::__variant_detail::__alt<0ul, WebCore::InlineIterator::BoxModernPath> const&) const 50 decltype(std::declval<auto>()(std::declval<std::__1::__variant_detail::__alt<0ul, WebCore::InlineIterator::BoxModernPath> const&>())) std::__1::__invoke[abi:v160006]<std::__1::__variant_detail::__visitation::__variant::__value_visitor<WTF::Visitor<WebCore::InlineIterator::Box::renderer() const::'lambda'(auto&)>>, std::__1::__variant_detail::__alt<0ul, WebCore::InlineIterator::BoxModernPath> const&>(auto&&, std::__1::__variant_detail::__alt<0ul, WebCore::InlineIterator::BoxModernPath> const&) 50 decltype(auto) std::__1::__variant_detail::__visitation::__base::__dispatcher<0ul>::__dispatch[abi:v160006]<std::__1::__variant_detail::__visitation::__variant::__value_visitor<WTF::Visitor<WebCore::InlineIterator::Box::renderer() const::'lambda'(auto&)>>&&, std::__1::__variant_detail::__base<(std::__1::__variant_detail::_Trait)1, WebCore::InlineIterator::BoxModernPath, WebCore::InlineIterator::BoxLegacyPath> const&>(auto, std::__1::__variant_detail::__base<(std::__1::__variant_detail::_Trait)1, WebCore::InlineIterator::BoxModernPath, WebCore::InlineIterator::BoxLegacyPath> const&) 50 decltype(auto) std::__1::__variant_detail::__visitation::__base::__visit_alt[abi:v160006]<std::__1::__variant_detail::__visitation::__variant::__value_visitor<WTF::Visitor<WebCore::InlineIterator::Box::renderer() const::'lambda'(auto&)>>, std::__1::__variant_detail::__impl<WebCore::InlineIterator::BoxModernPath, WebCore::InlineIterator::BoxLegacyPath> const&>(auto&&, std::__1::__variant_detail::__impl<WebCore::InlineIterator::BoxModernPath, WebCore::InlineIterator::BoxLegacyPath> const&) 50 decltype(auto) std::__1::__variant_detail::__visitation::__variant::__visit_alt[abi:v160006]<std::__1::__variant_detail::__visitation::__variant::__value_visitor<WTF::Visitor<WebCore::InlineIterator::Box::renderer() const::'lambda'(auto&)>>, std::__1::variant<WebCore::InlineIterator::BoxModernPath, WebCore::InlineIterator::BoxLegacyPath> const&>(auto&&, std::__1::variant<WebCore::InlineIterator::BoxModernPath, WebCore::InlineIterator::BoxLegacyPath> const&) 50 decltype(auto) std::__1::__variant_detail::__visitation::__variant::__visit_value[abi:v160006]<WTF::Visitor<WebCore::InlineIterator::Box::renderer() const::'lambda'(auto&)>, std::__1::variant<WebCore::InlineIterator::BoxModernPath, WebCore::InlineIterator::BoxLegacyPath> const&>(auto&&, std::__1::variant<WebCore::InlineIterator::BoxModernPath, WebCore::InlineIterator::BoxLegacyPath> const&) 50 decltype(auto) std::__1::visit[abi:v160006]<WTF::Visitor<WebCore::InlineIterator::Box::renderer() const::'lambda'(auto&)>, std::__1::variant<WebCore::InlineIterator::BoxModernPath, WebCore::InlineIterator::BoxLegacyPath> const&, void>(auto&&, std::__1::variant<WebCore::InlineIterator::BoxModernPath, WebCore::InlineIterator::BoxLegacyPath> const&) 50 decltype(std::visit(makeVisitor(std::forward<WebCore::InlineIterator::Box::renderer() const::'lambda'(auto&)>(fp0)), std::forward<auto>(fp))) WTF::switchOn<std::__1::variant<WebCore::InlineIterator::BoxModernPath, WebCore::InlineIterator::BoxLegacyPath> const&, WebCore::InlineIterator::Box::renderer() const::'lambda'(auto&)>(auto&&, WebCore::InlineIterator::Box::renderer() const::'lambda'(auto&)&&) 50 WebCore::InlineIterator::Box::renderer() const 50 WebCore::InlineIterator::InlineBox::renderer() const 50 auto WebCore::TextBoxPainter<WebCore::InlineIterator::BoxModernPath>::collectDecoratingBoxesForTextBox(WTF::Vector<WebCore::TextBoxPainter<WebCore::InlineIterator::BoxModernPath>::DecoratingBox, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&, WebCore::InlineIterator::TextBoxIterator const&, WebCore::FloatPoint, WebCore::TextDecorationPainter::Styles const&)::'lambda'(auto&, auto)::operator()<WebCore::InlineIterator::InlineBoxIterator, WebCore::TextBoxPainter<WebCore::InlineIterator::BoxModernPath>::collectDecoratingBoxesForTextBox(WTF::Vector<WebCore::TextBoxPainter<WebCore::InlineIterator::BoxModernPath>::DecoratingBox, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&, WebCore::InlineIterator::TextBoxIterator const&, WebCore::FloatPoint, WebCore::TextDecorationPainter::Styles const&)::UseOverriderDecorationStyle>(auto&, auto) const 50 WebCore::TextBoxPainter<WebCore::InlineIterator::BoxModernPath>::collectDecoratingBoxesForTextBox(WTF::Vector<WebCore::TextBoxPainter<WebCore::InlineIterator::BoxModernPath>::DecoratingBox, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&, WebCore::InlineIterator::TextBoxIterator const&, WebCore::FloatPoint, WebCore::TextDecorationPainter::Styles const&) 50 WebCore::TextBoxPainter<WebCore::InlineIterator::BoxModernPath>::paintBackgroundDecorations(WebCore::TextDecorationPainter&, WebCore::StyledMarkedText const&, WebCore::FloatRect const&) 50 WebCore::TextBoxPainter<WebCore::InlineIterator::BoxModernPath>::paintForegroundAndDecorations() 50 WebCore::TextBoxPainter<WebCore::InlineIterator::BoxModernPath>::paint()
Attachments
Add attachment
proposed patch, testcase, etc.
Antti Koivisto
Comment 1
2023-11-13 01:21:50 PST
rdar://117897402
Antti Koivisto
Comment 2
2023-11-13 01:26:37 PST
Pull request:
https://github.com/WebKit/WebKit/pull/20408
EWS
Comment 3
2023-11-13 06:12:55 PST
Committed
270634@main
(f9ec06b716a3): <
https://commits.webkit.org/270634@main
> Reviewed commits have been landed. Closing PR #20408 and removing active labels.
Note
You need to
log in
before you can comment on or make changes to this bug.
Top of Page
Format For Printing
XML
Clone This Bug