Commit 8f85f34d authored by Eric Seidel's avatar Eric Seidel

Fix 2 crashers found by Hixie's fuzzer.

The first one is that we weren't setting up a
FontCachePurgePreventer during drawText.  It's not clear
that this is the correct fix, since Blink doesn't have
this FontCachePurgePreventer here either, but it's also
possible that they would hit this same ASSERT and just
not care (since ASSERTs are disabled on clusterfuzz).

The second fix is making ExceptionState actually track
whether it has thrown an exception or not. The c++ code
was depending on this working in order to return early
from dom functions and not crash!

R=abarth@google.com
parent 9da399b0
...@@ -48,9 +48,12 @@ void doFrame(double timeStamp) { ...@@ -48,9 +48,12 @@ void doFrame(double timeStamp) {
node = root; node = root;
} else if (node != root && other != null && pickThis(0.1)) { } else if (node != root && other != null && pickThis(0.1)) {
report("insertBefore()"); report("insertBefore()");
node.insertBefore([other]); try {
node.insertBefore([other]);
} catch (_) {
}
break; break;
} else if (pickThis(0.001)) { } else if (node != root && pickThis(0.001)) {
report("remove()"); report("remove()");
node.remove(); node.remove();
} else if (node is sky.Element) { } else if (node is sky.Element) {
...@@ -148,7 +151,7 @@ void doFrame(double timeStamp) { ...@@ -148,7 +151,7 @@ void doFrame(double timeStamp) {
break; break;
} }
} else { } else {
assert(node is sky.Text); // assert(node is sky.Text);
final sky.Text text = node; final sky.Text text = node;
if (pickThis(0.1)) { if (pickThis(0.1)) {
report("appending a new text node (ASCII)"); report("appending a new text node (ASCII)");
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment