| commit | 05fa0d538694178adadaf58bb3e25b3fa8cf9d4b | [log] [tgz] |
|---|---|---|
| author | joone.hur@intel.com <joone.hur@intel.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> | Tue Oct 22 00:29:46 2013 +0000 |
| committer | joone.hur@intel.com <joone.hur@intel.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> | Tue Oct 22 00:29:46 2013 +0000 |
| tree | 3e1976a77d415c5c440d5cb841783e103da7b53c | |
| parent | 167e177f936376a402e2d7966a879d83d24bc6f0 [diff] |
Bad cast with toRenderBoxModelObject in RenderBlock::updateFirstLetter() https://bugs.webkit.org/show_bug.cgi?id=123013 Reviewed by Andreas Kling. No new tests because this was reported by Google ClusterFuzz. https://codereview.chromium.org/25713009/ There is a case that toRenderBoxModelObject causes a crash in RenderBlock::updateFirstLetter() due to bad cast, so we need to check whether the RenderObject is a RenderBoxModelObject by running isBoxModelObject() before calling toRenderBoxModelObject. * rendering/RenderBlock.cpp: (WebCore::RenderBlock::updateFirstLetter): git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157768 268f45cc-cd09-0410-ab3c-d52691b4dbfc