Fix null pointer in LayoutTable::UpdateCollapsedOuterBorders().

Check for null BottomNonEmptySection even if TopNonEmptySection is not null because of crbug.com/764525. Bug: 764284 Change-Id: I4d45cbd3432722a8958ba647767d97b782c10512 Reviewed-on: https://chromium-review.googlesource.com/664303 Reviewed-by: David Grogan <[email protected]> Commit-Queue: Xianzhu Wang <[email protected]> Cr-Commit-Position: refs/heads/master@{#501471}
tenta-browser · Sep 13, 2017 · 3343091 · 3343091
1 parent 157ea6e
commit 3343091
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 8 deletions.
diff --git a/third_party/WebKit/Source/core/layout/LayoutTable.cpp b/third_party/WebKit/Source/core/layout/LayoutTable.cpp
@@ -1664,16 +1664,18 @@ void LayoutTable::UpdateCollapsedOuterBorders() const {
     }
   }
 
-  const auto* bottom_section = BottomNonEmptySection();
-  DCHECK(bottom_section);
   // The table's after outer border width is the maximum after outer border
   // widths of all cells in the last row. See the CSS 2.1 spec, section 17.6.2.
-  unsigned row = bottom_section->NumRows() - 1;
-  unsigned bottom_cols = bottom_section->NumCols(row);
-  for (unsigned col = 0; col < bottom_cols; ++col) {
-    if (const auto* cell = bottom_section->PrimaryCellAt(row, col)) {
-      collapsed_outer_border_after_ = std::max(
-          collapsed_outer_border_after_, cell->CollapsedOuterBorderAfter());
+  // TODO(crbug.com/764525): Because of the bug, bottom_section can be null when
+  // top_section is not null. See LayoutTableTest.OutOfOrderHeadAndBody.
+  if (const auto* bottom_section = BottomNonEmptySection()) {
+    unsigned row = bottom_section->NumRows() - 1;
+    unsigned bottom_cols = bottom_section->NumCols(row);
+    for (unsigned col = 0; col < bottom_cols; ++col) {
+      if (const auto* cell = bottom_section->PrimaryCellAt(row, col)) {
+        collapsed_outer_border_after_ = std::max(
+            collapsed_outer_border_after_, cell->CollapsedOuterBorderAfter());
+      }
     }
   }
 

diff --git a/third_party/WebKit/Source/core/layout/LayoutTableTest.cpp b/third_party/WebKit/Source/core/layout/LayoutTableTest.cpp
@@ -233,6 +233,18 @@ TEST_F(LayoutTableTest, PaddingWithCollapsedBorder) {
   EXPECT_EQ(0, table->PaddingUnder());
 }
 
+TEST_F(LayoutTableTest, OutOfOrderHeadAndBody) {
+  // This should not crash.
+  SetBodyInnerHTML(
+      "<table style='border-collapse: collapse'>"
+      "  <tbody><tr><td>Body</td></tr></tbody>"
+      "  <thead></thead>"
+      "<table>");
+  // TODO(crbug.com/764525): Add tests for TopSection(), BottomSection(),
+  // TopNonEmptySection(), BottomNonEmptySection(), SectionAbove(),
+  // SectionBelow() for similar cases.
+}
+
 }  // anonymous namespace
 
 }  // namespace blink