summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorpdr <pdr@chromium.org>2016-03-22 16:23:23 -0700
committerCommit bot <commit-bot@chromium.org>2016-03-22 23:24:59 +0000
commit44a62c2cb9fa76ebae1aac0845dd9ed509b08e09 (patch)
tree6db619411d4a3033e9c9303595842d5141344987
parentf1fd8060090e8a17e298d5be9c17c822dbf29a76 (diff)
downloadchromium_src-44a62c2cb9fa76ebae1aac0845dd9ed509b08e09.zip
chromium_src-44a62c2cb9fa76ebae1aac0845dd9ed509b08e09.tar.gz
chromium_src-44a62c2cb9fa76ebae1aac0845dd9ed509b08e09.tar.bz2
Add workaround for invalid non-bmp character measurements in SVG
Before [1], invalid non-bmp characters were measured incorrectly but did not crash. This patch adds a workaround to updateSubrunRangesForCurrentPosition so it behaves more like ShapeResultBuffer::getCharacterRange in the presence of invalid non-bmp characters. https://crbug.com/595960 has been filed to investigate the root cause of this. [1] https://chromium.googlesource.com/chromium/src/+/a3a50c140c60eb242df3dd4df06fe55cad117c75 BUG=595393 Review URL: https://codereview.chromium.org/1816453002 Cr-Commit-Position: refs/heads/master@{#382727}
-rw-r--r--third_party/WebKit/LayoutTests/svg/text/invalid-non-bmp-characters.html22
-rw-r--r--third_party/WebKit/Source/core/layout/svg/SVGTextMetricsBuilder.cpp6
2 files changed, 28 insertions, 0 deletions
diff --git a/third_party/WebKit/LayoutTests/svg/text/invalid-non-bmp-characters.html b/third_party/WebKit/LayoutTests/svg/text/invalid-non-bmp-characters.html
new file mode 100644
index 0000000..0021de1
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/svg/text/invalid-non-bmp-characters.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+<svg id="svg" height="0" font-size="100">
+ <text id="text">
+ <!-- invalid non-bmp character followed by a valid character -->
+ <tspan>&#x90012;a</tspan>
+ <!-- many invalid non-bmp characters followed by a valid character -->
+ <tspan>&#x90012;&#x90012;&#x90012;&#x90012;a&#x90012;&#x90012;&#x90012;&#x90012;a</tspan>
+ <!-- alternating valid and invalid non-bmp characters -->
+ <tspan>&#128514;&#x90012;&#128514;&#x90012;&#128514;&#x90012;</tspan>
+ <!-- invalid non-bmp characters in rtl -->
+ <tspan direction="rtl">نشاط&#128514;نشاط&#x90012;&#x90012;ن&#x90012;شاط&#128514;نش&#x90012;اط&#x90012;ا</tspan>
+ </text>
+</svg>
+<script>
+test(function() {
+ text.getComputedTextLength();
+ svg.parentElement.removeChild(svg);
+}, 'Text runs with invalid non-bmp characters should not crash.');
+</script>
diff --git a/third_party/WebKit/Source/core/layout/svg/SVGTextMetricsBuilder.cpp b/third_party/WebKit/Source/core/layout/svg/SVGTextMetricsBuilder.cpp
index 8791737..7c212e9 100644
--- a/third_party/WebKit/Source/core/layout/svg/SVGTextMetricsBuilder.cpp
+++ b/third_party/WebKit/Source/core/layout/svg/SVGTextMetricsBuilder.cpp
@@ -161,6 +161,12 @@ unsigned SVGTextMetricsCalculator::updateSubrunRangesForCurrentPosition()
}
}
+ // TODO(pdr): m_subrunRanges can be too short in the presence of invalid
+ // unicode characters (see: crbug.com/595960). This is a temporary
+ // workaround to ensure the returned index is valid for m_subrunRages.
+ if (positionInRun >= m_subrunRanges.size())
+ return 0;
+
return positionInRun;
}