[IFC] Do not try to measure text content across InlineItems

https://bugs.webkit.org/show_bug.cgi?id=260935 <rdar://114696241> Reviewed by Antti Koivisto. This happens when ubidi_getLogicalRun makes us split inside a cluster (bug?) producing multiple InlineItems. (simplifiedMinimumInstrinsicWidthBreak extra check is added to mirror what we already do at the slow codepath) * LayoutTests/fast/text/complex-text-with-bidi-boundary-crash-expected.txt: Added. * LayoutTests/fast/text/complex-text-with-bidi-boundary-crash.html: Added. * Source/WebCore/layout/formattingContexts/inline/InlineContentBreaker.cpp: (WebCore::Layout::InlineContentBreaker::simplifiedMinimumInstrinsicWidthBreak const): * Source/WebCore/layout/formattingContexts/inline/text/TextUtil.cpp: (WebCore::Layout::TextUtil::firstUserPerceivedCharacterLength): Canonical link: https://commits.webkit.org/267495@main
WebKit · Aug 31, 2023 · 1a2b1a5 · 1a2b1a5
1 parent 734bc0c
commit 1a2b1a5
Show file tree

Hide file tree

Showing 4 changed files with 18 additions and 2 deletions.
diff --git a/LayoutTests/fast/text/complex-text-with-bidi-boundary-crash-expected.txt b/LayoutTests/fast/text/complex-text-with-bidi-boundary-crash-expected.txt
@@ -0,0 +1 @@
+࢐𐠀
diff --git a/LayoutTests/fast/text/complex-text-with-bidi-boundary-crash.html b/LayoutTests/fast/text/complex-text-with-bidi-boundary-crash.html
@@ -0,0 +1,14 @@
+<style>
+div {
+  float: left;
+  word-break: break-word;
+}
+</style>
+<!-- PASS if no crash or assert -->
+<div id=container></div>
+<script>
+if (window.testRunner)
+  testRunner.dumpAsText();
+document.body.offsetHeight;
+container.append('\u0890\ud802\udc00');
+</script>
diff --git a/Source/WebCore/layout/formattingContexts/inline/InlineContentBreaker.cpp b/Source/WebCore/layout/formattingContexts/inline/InlineContentBreaker.cpp
@@ -264,7 +264,7 @@ std::optional<InlineContentBreaker::Result> InlineContentBreaker::simplifiedMini
 
         if (breakBehavior.containsAny({ WordBreakRule::AtArbitraryPositionWithinWords, WordBreakRule::AtArbitraryPosition })) {
             auto firstCharacterLength = TextUtil::firstUserPerceivedCharacterLength(leadingInlineTextItem);
-            if (leadingInlineTextItem.length() == firstCharacterLength)
+            if (leadingInlineTextItem.length() <= firstCharacterLength)
                 return Result { Result::Action::Keep, IsEndOfLine::Yes };
             auto firstCharacterWidth = TextUtil::width(leadingInlineTextItem, style.fontCascade(), leadingInlineTextItem.start(), leadingInlineTextItem.start() + firstCharacterLength, { }, TextUtil::UseTrailingWhitespaceMeasuringOptimization::No);
             return Result { Result::Action::Break, IsEndOfLine::Yes, Result::PartialTrailingContent { { }, PartialRun { firstCharacterLength, firstCharacterWidth }, { } } };

diff --git a/Source/WebCore/layout/formattingContexts/inline/text/TextUtil.cpp b/Source/WebCore/layout/formattingContexts/inline/text/TextUtil.cpp
@@ -471,7 +471,8 @@ size_t TextUtil::firstUserPerceivedCharacterLength(const InlineTextBox& inlineTe
 
 size_t TextUtil::firstUserPerceivedCharacterLength(const InlineTextItem& inlineTextItem)
 {
-    return firstUserPerceivedCharacterLength(inlineTextItem.inlineTextBox(), inlineTextItem.start(), inlineTextItem.length());
+    auto length = firstUserPerceivedCharacterLength(inlineTextItem.inlineTextBox(), inlineTextItem.start(), inlineTextItem.length());
+    return std::min<size_t>(inlineTextItem.length(), length);
 }
 
 TextDirection TextUtil::directionForTextContent(StringView content)