Crash when setting 'font' CSS property to 'calc(2 * 3)'
authorcdumez@apple.com <cdumez@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 21 Nov 2014 19:00:56 +0000 (19:00 +0000)
committercdumez@apple.com <cdumez@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 21 Nov 2014 19:00:56 +0000 (19:00 +0000)
https://bugs.webkit.org/show_bug.cgi?id=138933

Reviewed by Darin Adler.

Source/WebCore:

The CSS Parser was not handling calculated values when parsing the font
weight. This would lead us to hit an assertion when parsing a font
property whose weight is set to a calculated value.

This patch updates parseFontWeight() to properly handle calculated
values.

Test: fast/css/font-calculated-value.html

* css/CSSParser.cpp:
(WebCore::CSSParser::parseFontWeight):

LayoutTests:

Add a layout test to cover the case where the 'font' CSS property is
set to a value whose weight is a calculated value, to make sure it
does not crash and behaves as intended.

* fast/css/font-calculated-value-expected.txt: Added.
* fast/css/font-calculated-value.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@176454 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/fast/css/font-calculated-value-expected.txt [new file with mode: 0644]
LayoutTests/fast/css/font-calculated-value.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/css/CSSParser.cpp

index 7885e80..0116e0c 100644 (file)
@@ -1,3 +1,17 @@
+2014-11-21  Chris Dumez  <cdumez@apple.com>
+
+        Crash when setting 'font' CSS property to 'calc(2 * 3)'
+        https://bugs.webkit.org/show_bug.cgi?id=138933
+
+        Reviewed by Darin Adler.
+
+        Add a layout test to cover the case where the 'font' CSS property is
+        set to a value whose weight is a calculated value, to make sure it
+        does not crash and behaves as intended.
+
+        * fast/css/font-calculated-value-expected.txt: Added.
+        * fast/css/font-calculated-value.html: Added.
+
 2014-11-21  Bear Travis  <betravis@gmail.com>
 
         [CSS Font Loading] Switch to dispatching events asynchronously
diff --git a/LayoutTests/fast/css/font-calculated-value-expected.txt b/LayoutTests/fast/css/font-calculated-value-expected.txt
new file mode 100644 (file)
index 0000000..2b7bf55
--- /dev/null
@@ -0,0 +1,13 @@
+Tests assigning a calculated value to 'font' CSS property.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS testDiv.style['font'] is ""
+testDiv.style['font'] = 'italic small-caps calc(100 * 9) 12px arial'
+PASS testDiv.style['font'] is "italic small-caps 900 12px arial"
+PASS window.getComputedStyle(testDiv).getPropertyValue('font') is "italic small-caps 900 12px/normal arial"
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/fast/css/font-calculated-value.html b/LayoutTests/fast/css/font-calculated-value.html
new file mode 100644 (file)
index 0000000..fcb6598
--- /dev/null
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<body>
+<script src="../../resources/js-test-pre.js"></script>
+<div id="testDiv""></div>
+<script>
+description("Tests assigning a calculated value to 'font' CSS property.");
+
+var testDiv = document.getElementById("testDiv");
+
+shouldBeEmptyString("testDiv.style['font']");
+evalAndLog("testDiv.style['font'] = 'italic small-caps calc(100 * 9) 12px arial'");
+shouldBeEqualToString("testDiv.style['font']", "italic small-caps 900 12px arial");
+shouldBeEqualToString("window.getComputedStyle(testDiv).getPropertyValue('font')", "italic small-caps 900 12px/normal arial");
+
+</script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
index 205329e..742daf4 100644 (file)
@@ -1,3 +1,22 @@
+2014-11-21  Chris Dumez  <cdumez@apple.com>
+
+        Crash when setting 'font' CSS property to 'calc(2 * 3)'
+        https://bugs.webkit.org/show_bug.cgi?id=138933
+
+        Reviewed by Darin Adler.
+
+        The CSS Parser was not handling calculated values when parsing the font
+        weight. This would lead us to hit an assertion when parsing a font
+        property whose weight is set to a calculated value.
+
+        This patch updates parseFontWeight() to properly handle calculated
+        values.
+
+        Test: fast/css/font-calculated-value.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFontWeight):
+
 2014-11-21  Bear Travis  <betravis@gmail.com>
 
         [CSS Font Loading] Switch to dispatching events asynchronously
index c142c63..9ec2178 100644 (file)
@@ -6448,7 +6448,7 @@ bool CSSParser::parseFontWeight(bool important)
         return true;
     }
     if (validUnit(value, FInteger | FNonNeg, CSSQuirksMode)) {
-        int weight = static_cast<int>(value->fValue);
+        int weight = static_cast<int>(parsedDouble(value, ReleaseParsedCalcValue));
         if (!(weight % 100) && weight >= 100 && weight <= 900) {
             addProperty(CSSPropertyFontWeight, cssValuePool().createIdentifierValue(createFontWeightValueKeyword(weight)), important);
             return true;