Cherry-pick c36c902. rdar://115842183

jsc_fuz/wktr: RELEASE_ASSERT(to <= inlineTextItem.end()); in WebCore::Layout::TextUtil::width(...) (TextUtil.cpp:96). https://bugs.webkit.org/show_bug.cgi?id=262799 rdar://115842183. Reviewed by Alan Baradlay. Modified IntrinsicWidthHandler::simplifiedMinimumWidth() API to calculate width for grapheme-clusters spanning adjacent inline textitems. Test : fast/text/crash-grapheme-cluster-spanning-adjacent-textitems.html. * Source/WebCore/layout/formattingContexts/inline/IntrinsicWidthHandler.cpp : Changing API to consider grapheme-clusters spanning adjacent inline textitems. * LayoutTests/fast/text/crash-grapheme-cluster-spanning-adjacent-textitems.html : Added test case. * LayoutTests/fast/text/crash-grapheme-cluster-spanning-adjacent-textitems-expected.html : Added test expected file. Canonical link: https://commits.webkit.org/269276@main Identifier: 267815.310@safari-7617.1.11.10-branch
WebKit · Oct 16, 2023 · f312024 · f312024
1 parent 7c73c0b
commit f312024
Show file tree

Hide file tree

Showing 3 changed files with 13 additions and 1 deletion.
diff --git a/LayoutTests/fast/text/crash-grapheme-cluster-spanning-adjacent-textitems-expected.txt b/LayoutTests/fast/text/crash-grapheme-cluster-spanning-adjacent-textitems-expected.txt
@@ -0,0 +1,2 @@
+؀🀀
+This test used for grapheme cluster spanning adjucent inline text-items.PASS if no crash or ASSERT.
diff --git a/LayoutTests/fast/text/crash-grapheme-cluster-spanning-adjacent-textitems.html b/LayoutTests/fast/text/crash-grapheme-cluster-spanning-adjacent-textitems.html
@@ -0,0 +1,6 @@
+<div style="float: left; line-break: anywhere">&#1536;&#126976;</div>
+<p>This test used for grapheme cluster spanning adjucent inline text-items.PASS if no crash or ASSERT.</p>
+<script>
+if (window.testRunner)
+  testRunner.dumpAsText();
+</script>
diff --git a/Source/WebCore/layout/formattingContexts/inline/IntrinsicWidthHandler.cpp b/Source/WebCore/layout/formattingContexts/inline/IntrinsicWidthHandler.cpp
@@ -146,7 +146,11 @@ InlineLayoutUnit IntrinsicWidthHandler::simplifiedMinimumWidth() const
                 auto characterIndex = inlineTextItem.start() + index;
                 auto characterLength = TextUtil::firstUserPerceivedCharacterLength(inlineTextItem.inlineTextBox(), characterIndex, contentLength - index);
                 ASSERT(characterLength);
-                maximumWidth = std::max(maximumWidth, TextUtil::width(inlineTextItem, fontCascade, characterIndex, characterIndex + characterLength, { }, TextUtil::UseTrailingWhitespaceMeasuringOptimization::No));
+                if (characterIndex + characterLength > inlineTextItem.end()) {
+                    // grapheme clusters could span across multiple adjacent inline text items.
+                    maximumWidth = std::max(maximumWidth, TextUtil::width(inlineTextItem.inlineTextBox(), fontCascade, characterIndex, characterIndex + characterLength, { }, TextUtil::UseTrailingWhitespaceMeasuringOptimization::No));
+                } else
+                    maximumWidth = std::max(maximumWidth, TextUtil::width(inlineTextItem, fontCascade, characterIndex, characterIndex + characterLength, { }, TextUtil::UseTrailingWhitespaceMeasuringOptimization::No));
                 index += characterLength;
             }
             continue;