ASSERTION FAILED: result in WebCore::CSSParser::parseURI
authoraestes@apple.com <aestes@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 3 Oct 2016 17:44:29 +0000 (17:44 +0000)
committeraestes@apple.com <aestes@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 3 Oct 2016 17:44:29 +0000 (17:44 +0000)
https://bugs.webkit.org/show_bug.cgi?id=141638
<rdar://problem/27709952>

Reviewed by Andreas Kling.

Source/WebCore:

CSSParser::parseURIInternal() failed to parse unquoted URLs with Unicode escape sequences
greater than 0xFF, even when the destination character type was multi-byte. Fixed by
checking the size of DestCharacterType instead of SrcCharacterType.

Updated fast/css/url-with-multi-byte-unicode-escape.html to test for an unquoted URL.

* css/parser/CSSParser.cpp:
(WebCore::CSSParser::parseURIInternal): For code points greater than 0xFF, only returned
false if sizeof(DestCharacterType) == 1.

LayoutTests:

* fast/css/url-with-multi-byte-unicode-escape-expected.txt: Added a test for an unquoted URL.
* fast/css/url-with-multi-byte-unicode-escape.html:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@206736 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/fast/css/url-with-multi-byte-unicode-escape-expected.txt
LayoutTests/fast/css/url-with-multi-byte-unicode-escape.html
Source/WebCore/ChangeLog
Source/WebCore/css/parser/CSSParser.cpp

index 861c0e7..c0280cf 100644 (file)
@@ -1,3 +1,14 @@
+2016-10-03  Andy Estes  <aestes@apple.com>
+
+        ASSERTION FAILED: result in WebCore::CSSParser::parseURI
+        https://bugs.webkit.org/show_bug.cgi?id=141638
+        <rdar://problem/27709952>
+
+        Reviewed by Andreas Kling.
+
+        * fast/css/url-with-multi-byte-unicode-escape-expected.txt: Added a test for an unquoted URL.
+        * fast/css/url-with-multi-byte-unicode-escape.html:
+
 2016-10-03  Chris Dumez  <cdumez@apple.com>
 
         td.scope should only return known values
index af8b6b8..c0d214c 100644 (file)
@@ -5,6 +5,7 @@ On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE
 
 PASS document.styleSheets[0].cssRules.length is 2
 PASS document.styleSheets[0].cssRules[0].style.getPropertyValue("background-image") is "url(data:%C4%80)"
+PASS document.styleSheets[0].cssRules[0].style.getPropertyValue("border-image-source") is "url(data:%C4%80)"
 PASS document.styleSheets[0].cssRules[1].style.getPropertyValue("background-color") is "green"
 PASS window.getComputedStyle(document.getElementById("test")).getPropertyValue("background-color") is "rgb(0, 128, 0)"
 PASS successfullyParsed is true
index d2d8bed..a3d8fc4 100644 (file)
@@ -1,7 +1,7 @@
 <!DOCTYPE html>
 <html>
 <head>
-<style>#test { background-image: url("data:\100")} #test { background-color: green !important }</style>
+<style>#test { background-image: url("data:\100"); border-image: url(data:\100); } #test { background-color: green !important; }</style>
 <script src="../../resources/js-test-pre.js"></script>
 <script>
     if (window.testRunner)
@@ -14,6 +14,7 @@
     description('Test parsing a CSS URI containing a multi-byte Unicode escape sequence.');
     shouldBe('document.styleSheets[0].cssRules.length', '2');
     shouldBeEqualToString('document.styleSheets[0].cssRules[0].style.getPropertyValue("background-image")', 'url(data:%C4%80)');
+    shouldBeEqualToString('document.styleSheets[0].cssRules[0].style.getPropertyValue("border-image-source")', 'url(data:%C4%80)');
     shouldBeEqualToString('document.styleSheets[0].cssRules[1].style.getPropertyValue("background-color")', 'green');
     shouldBeEqualToString('window.getComputedStyle(document.getElementById("test")).getPropertyValue("background-color")', 'rgb(0, 128, 0)');
 </script>
index dec0532..7f5dad8 100644 (file)
@@ -1,3 +1,21 @@
+2016-10-03  Andy Estes  <aestes@apple.com>
+
+        ASSERTION FAILED: result in WebCore::CSSParser::parseURI
+        https://bugs.webkit.org/show_bug.cgi?id=141638
+        <rdar://problem/27709952>
+
+        Reviewed by Andreas Kling.
+
+        CSSParser::parseURIInternal() failed to parse unquoted URLs with Unicode escape sequences
+        greater than 0xFF, even when the destination character type was multi-byte. Fixed by
+        checking the size of DestCharacterType instead of SrcCharacterType.
+
+        Updated fast/css/url-with-multi-byte-unicode-escape.html to test for an unquoted URL.
+
+        * css/parser/CSSParser.cpp:
+        (WebCore::CSSParser::parseURIInternal): For code points greater than 0xFF, only returned
+        false if sizeof(DestCharacterType) == 1.
+
 2016-10-03  Alex Christensen  <achristensen@webkit.org>
 
         URLParser: empty relative URLs should not copy fragment from the base URL
index cc27994..52c11cd 100644 (file)
@@ -11736,7 +11736,7 @@ inline bool CSSParser::parseURIInternal(SrcCharacterType*& src, DestCharacterTyp
             *dest++ = *src++;
         else {
             unsigned unicode = parseEscape<SrcCharacterType>(src);
-            if (unicode > 0xff && sizeof(SrcCharacterType) == 1)
+            if (unicode > 0xff && sizeof(DestCharacterType) == 1)
                 return false;
             UnicodeToChars(dest, unicode);
         }