browsers.fail
← webkit

commit f91ce22de428

[line-clamp] Share the text truncation of content and the block ellipsis

webkit out-of-bounds heuristic WebCore

commit message

[line-clamp] Share the text truncation of content and the block ellipsis
https://bugs.webkit.org/show_bug.cgi?id=329840

Reviewed by Alan Baradlay.

text-overflow truncates both the line's content (truncate) and a block ellipsis that still overflows the line
(truncateBlockEllipsisForTextOverflow, added in 329149), but the block ellipsis had its own copy of the truncation rules,
since TextUtil::breakWord only worked on an InlineTextBox.

Now TextUtil::breakWord is implemented on a StringView and a width function, with the existing InlineTextBox variant and a
new StringView variant for text that is not inline content. The truncation rules (end-edge truncation in either direction
and the first-character rule) move into truncateText, which both the content and the block ellipsis use.

For text in the direction opposite to the line's, truncateText drops and keeps whole user perceived characters. Content
truncation used to step by a single UTF-16 code unit there, which could split a surrogate pair or a grapheme cluster; that
was mostly hidden because content is painted clipped, but the block ellipsis is painted as the truncated string and would
show it. Text in the direction opposite to the line's with no available width also no longer asserts in TextUtil::breakWord
(it keeps the last character).

Tests: fast/inline/line-clamp-text-overflow-block-ellipsis-mismatching-direction-emoji.html
       fast/inline/text-overflow-ellipsis-mismatching-direction-grapheme.html

* LayoutTests/fast/inline/line-clamp-text-overflow-block-ellipsis-mismatching-direction-emoji-expected.html: Added.
* LayoutTests/fast/inline/line-clamp-text-overflow-block-ellipsis-mismatching-direction-emoji.html: Added.
* LayoutTests/fast/inline/text-overflow-ellipsis-mismatching-direction-grapheme-expected.html: Added.
* LayoutTests/fast/inline/text-overflow-ellipsis-mismatching-direction-grapheme.html: Added.
* Source/WebCore/layout/formattingContexts/inline/display/InlineDisplayLineBuilder.cpp:
(WebCore::Layout::truncateText): Factored out of truncate and truncateTextContentWithMismatchingDirection. Drop and keep
whole user perceived characters.
(WebCore::Layout::truncate):
(WebCore::Layout::visiblePartOfTextRun): Use truncateText.
(WebCore::Layout::truncateBlockEllipsisForTextOverflow):
(WebCore::Layout::truncateTextContentWithMismatchingDirection): Deleted.
* Source/WebCore/layout/formattingContexts/inline/text/TextUtil.cpp:
(WebCore::Layout::breakWord): Factored out of TextUtil::breakWord, measuring with a width function. The end of the text is a
user perceived character boundary (StringView, unlike String, asserts on an out of bounds index).
(WebCore::Layout::TextUtil::breakWord):
(WebCore::Layout::TextUtil::firstUserPerceivedCharacterLength):
(WebCore::Layout::TextUtil::lastUserPerceivedCharacterLength):
* Source/WebCore/layout/formattingContexts/inline/text/TextUtil.h:

Canonical link: https://commits.webkit.org/325687@main

files

  • LayoutTests/fast/inline/line-clamp-text-overflow-block-ellipsis-mismatching-direction-emoji-expected.html
  • LayoutTests/fast/inline/line-clamp-text-overflow-block-ellipsis-mismatching-direction-emoji.html
  • LayoutTests/fast/inline/text-overflow-ellipsis-mismatching-direction-grapheme-expected.html
  • LayoutTests/fast/inline/text-overflow-ellipsis-mismatching-direction-grapheme.html
  • Source/WebCore/layout/formattingContexts/inline/display/InlineDisplayLineBuilder.cpp
  • Source/WebCore/layout/formattingContexts/inline/text/TextUtil.cpp
  • Source/WebCore/layout/formattingContexts/inline/text/TextUtil.h

this commit matched a vulnerability pattern in its message. WebKit does not publish a security bug for every fix, so treat it as a lead, not as a CVE record.