Bug 52031 - crash if CSS combination of font-variant: small-caps and :first-letter
Summary: crash if CSS combination of font-variant: small-caps and :first-letter
Status: RESOLVED FIXED
Alias: None
Product: konqueror
Classification: Applications
Component: khtml (show other bugs)
Version: 4.0
Platform: Compiled Sources Linux
: NOR crash
Target Milestone: ---
Assignee: Konqueror Developers
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2002-12-17 19:32 UTC by Wolfgang Thiess
Modified: 2003-01-04 23:33 UTC (History)
0 users

See Also:
Latest Commit:
Version Fixed In:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Wolfgang Thiess 2002-12-17 19:32:13 UTC
Version:           4.0 (using KDE 3.0.8 (KDE 3.1 beta2))
Installed from:    compiled sources
Compiler:          gcc version 2.95.4 20010319 (prerelease/franzo/20011204)
OS:          Linux (ppc) release 2.4.19-4a

This little Page causes my konqi 3.0.8 to crash:

<head>
<title>Test</title>
<style>
H1 {
  font-variant: small-caps;
}
H1:first-letter {
  font-size: x-large;
}
</style>
</head>
<body>
<h1>ABcd</h1>
</body>
</html>

I expect four letters, a big 'A' followed by 'BCD'.

Regards
Wolfgang
Comment 1 Dirk Mueller 2003-01-04 23:33:53 UTC
Subject: kdelibs/khtml/rendering

CVS commit by mueller: 

keep the string referenced before copying
CCMAIL: 52031-done@bugs.kde.org


  M +1 -3      render_flow.cpp   1.315


--- kdelibs/khtml/rendering/render_flow.cpp  #1.314:1.315
@@ -1333,7 +1333,4 @@ void RenderFlow::addChild(RenderObject *
                     length++;
                 length++;
-                //kdDebug( 6040 ) << "letter= '" << DOMString(oldText->substring(0,length)).string() << "'" << endl;
-                newTextChild->setText(oldText->substring(length,oldText->l-length));
-
                 RenderText* letter = new RenderText(0 /* anonymous object */, oldText->substring(0,length));
                 RenderStyle* newStyle = new RenderStyle();
@@ -1342,4 +1339,5 @@ void RenderFlow::addChild(RenderObject *
                 letter->setIsAnonymousBox(true);
                 firstLetter->addChild(letter);
+                newTextChild->setText(oldText->substring(length,oldText->l-length));
             }
             firstLetter->close();