Merge r182962 - RenderTableCell::computeCollapsed*Border() should che…

…ck if the cell is still attached to the render tree. https://bugs.webkit.org/show_bug.cgi?id=143887 rdar://problem/20568989 Reviewed by Simon Fraser. Detached table cell has no access to its parent table. This is a speculative fix to avoid dereferencing the invalid table pointer. * rendering/RenderTableCell.cpp: (WebCore::RenderTableCell::computeCollapsedStartBorder): (WebCore::RenderTableCell::computeCollapsedEndBorder): (WebCore::RenderTableCell::computeCollapsedBeforeBorder): (WebCore::RenderTableCell::computeCollapsedAfterBorder):
WebKit · May 11, 2015 · c6e4a53 · c6e4a53
1 parent dbdd35c
commit c6e4a53
Show file tree

Hide file tree

Showing 2 changed files with 33 additions and 12 deletions.
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
@@ -1,3 +1,20 @@
+2015-04-17  Zalan Bujtas  <zalan@apple.com>
+
+        RenderTableCell::computeCollapsed*Border() should check if the cell is still attached to the render tree.
+        https://bugs.webkit.org/show_bug.cgi?id=143887
+        rdar://problem/20568989
+
+        Reviewed by Simon Fraser.
+
+        Detached table cell has no access to its parent table. This is a speculative fix to
+        avoid dereferencing the invalid table pointer.
+
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::computeCollapsedStartBorder):
+        (WebCore::RenderTableCell::computeCollapsedEndBorder):
+        (WebCore::RenderTableCell::computeCollapsedBeforeBorder):
+        (WebCore::RenderTableCell::computeCollapsedAfterBorder):
+
 2015-04-17  Carlos Garcia Campos  <cgarcia@igalia.com>
 
         [SOUP] Redirect to non HTTP destination is broken

diff --git a/Source/WebCore/rendering/RenderTableCell.cpp b/Source/WebCore/rendering/RenderTableCell.cpp
@@ -540,14 +540,15 @@ CollapsedBorderValue RenderTableCell::collapsedStartBorder(IncludeBorderColorOrN
 
 CollapsedBorderValue RenderTableCell::computeCollapsedStartBorder(IncludeBorderColorOrNot includeColor) const
 {
-    RenderTable* table = this->table();
-
     // For the start border, we need to check, in order of precedence:
     // (1) Our start border.
     int startColorProperty = includeColor ? CSSProperty::resolveDirectionAwareProperty(CSSPropertyWebkitBorderStartColor, styleForCellFlow().direction(), styleForCellFlow().writingMode()) : 0;
     int endColorProperty = includeColor ? CSSProperty::resolveDirectionAwareProperty(CSSPropertyWebkitBorderEndColor, styleForCellFlow().direction(), styleForCellFlow().writingMode()) : 0;
     CollapsedBorderValue result(style().borderStart(), includeColor ? style().visitedDependentColor(startColorProperty) : Color(), BCELL);
 
+    RenderTable* table = this->table();
+    if (!table)
+        return result;
     // (2) The end border of the preceding cell.
     RenderTableCell* cellBefore = table->cellBefore(this);
     if (cellBefore) {
@@ -650,17 +651,18 @@ CollapsedBorderValue RenderTableCell::collapsedEndBorder(IncludeBorderColorOrNot
 
 CollapsedBorderValue RenderTableCell::computeCollapsedEndBorder(IncludeBorderColorOrNot includeColor) const
 {
-    RenderTable* table = this->table();
-    // Note: We have to use the effective column information instead of whether we have a cell after as a table doesn't
-    // have to be regular (any row can have less cells than the total cell count).
-    bool isEndColumn = table->colToEffCol(col() + colSpan() - 1) == table->numEffCols() - 1;
-
     // For end border, we need to check, in order of precedence:
     // (1) Our end border.
     int startColorProperty = includeColor ? CSSProperty::resolveDirectionAwareProperty(CSSPropertyWebkitBorderStartColor, styleForCellFlow().direction(), styleForCellFlow().writingMode()) : 0;
     int endColorProperty = includeColor ? CSSProperty::resolveDirectionAwareProperty(CSSPropertyWebkitBorderEndColor, styleForCellFlow().direction(), styleForCellFlow().writingMode()) : 0;
     CollapsedBorderValue result = CollapsedBorderValue(style().borderEnd(), includeColor ? style().visitedDependentColor(endColorProperty) : Color(), BCELL);
-
+
+    RenderTable* table = this->table();
+    if (!table)
+        return result;
+    // Note: We have to use the effective column information instead of whether we have a cell after as a table doesn't
+    // have to be regular (any row can have less cells than the total cell count).
+    bool isEndColumn = table->colToEffCol(col() + colSpan() - 1) == table->numEffCols() - 1;
     // (2) The start border of the following cell.
     if (!isEndColumn) {
         if (RenderTableCell* cellAfter = table->cellAfter(this)) {
@@ -762,14 +764,15 @@ CollapsedBorderValue RenderTableCell::collapsedBeforeBorder(IncludeBorderColorOr
 
 CollapsedBorderValue RenderTableCell::computeCollapsedBeforeBorder(IncludeBorderColorOrNot includeColor) const
 {
-    RenderTable* table = this->table();
-
     // For before border, we need to check, in order of precedence:
     // (1) Our before border.
     int beforeColorProperty = includeColor ? CSSProperty::resolveDirectionAwareProperty(CSSPropertyWebkitBorderBeforeColor, styleForCellFlow().direction(), styleForCellFlow().writingMode()) : 0;
     int afterColorProperty = includeColor ? CSSProperty::resolveDirectionAwareProperty(CSSPropertyWebkitBorderAfterColor, styleForCellFlow().direction(), styleForCellFlow().writingMode()) : 0;
     CollapsedBorderValue result = CollapsedBorderValue(style().borderBefore(), includeColor ? style().visitedDependentColor(beforeColorProperty) : Color(), BCELL);
 
+    RenderTable* table = this->table();
+    if (!table)
+        return result;
     RenderTableCell* prevCell = table->cellAbove(this);
     if (prevCell) {
         // (2) A before cell's after border.
@@ -858,14 +861,15 @@ CollapsedBorderValue RenderTableCell::collapsedAfterBorder(IncludeBorderColorOrN
 
 CollapsedBorderValue RenderTableCell::computeCollapsedAfterBorder(IncludeBorderColorOrNot includeColor) const
 {
-    RenderTable* table = this->table();
-
     // For after border, we need to check, in order of precedence:
     // (1) Our after border.
     int beforeColorProperty = includeColor ? CSSProperty::resolveDirectionAwareProperty(CSSPropertyWebkitBorderBeforeColor, styleForCellFlow().direction(), styleForCellFlow().writingMode()) : 0;
     int afterColorProperty = includeColor ? CSSProperty::resolveDirectionAwareProperty(CSSPropertyWebkitBorderAfterColor, styleForCellFlow().direction(), styleForCellFlow().writingMode()) : 0;
     CollapsedBorderValue result = CollapsedBorderValue(style().borderAfter(), includeColor ? style().visitedDependentColor(afterColorProperty) : Color(), BCELL);
 
+    RenderTable* table = this->table();
+    if (!table)
+        return result;
     RenderTableCell* nextCell = table->cellBelow(this);
     if (nextCell) {
         // (2) An after cell's before border.