git://git.webkit.org / WebKit-https.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 276d681)
Fix by Mitz Pettel, reviewed by Eric.
authorap <ap@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 19 Apr 2006 16:45:13 +0000 (16:45 +0000)
committerap <ap@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 19 Apr 2006 16:45:13 +0000 (16:45 +0000)
        - fix http://bugzilla.opendarwin.org/show_bug.cgi?id=8469
          CRASH: WebCore::CSSParser::parseDashboardRegions when attr() is passed

        Test: fast/css/dashboard-regions-attr-crash.html

        * css/cssparser.cpp:
        (WebCore::CSSParser::parseDashboardRegions): Added null check for args.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@13969 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog patch | blob | history
LayoutTests/fast/css/dashboard-regions-attr-crash-expected.txt [new file with mode: 0644] patch | blob
LayoutTests/fast/css/dashboard-regions-attr-crash.html [new file with mode: 0644] patch | blob
WebCore/ChangeLog patch | blob | history
WebCore/css/cssparser.cpp patch | blob | history

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 4471318ab348405045003551c9bd11ce5c7b1d98..9d9773c25adb8824794811f250f5ebaba3fcff4f 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2006-04-19  Mitz Pettel  <opendarwin.org@mitzpettel.com>
+
+        Reviewed by Eric, landed by ap.
+
+        - test for http://bugzilla.opendarwin.org/show_bug.cgi?id=8469
+          CRASH: WebCore::CSSParser::parseDashboardRegions when attr() is passed
+
+        * fast/css/dashboard-regions-attr-crash-expected.txt
+        * fast/css/dashboard-regions-attr-crash.html
+
 2006-04-17  Rob Buis  <buis@kde.org>
 
         Reviewed by eseidel.  Landed by eseidel.
diff --git a/LayoutTests/fast/css/dashboard-regions-attr-crash-expected.txt b/LayoutTests/fast/css/dashboard-regions-attr-crash-expected.txt
new file mode 100644 (file)
index 0000000..3b819b8
--- /dev/null
+++ b/LayoutTests/fast/css/dashboard-regions-attr-crash-expected.txt
@@ -0,0 +1,6 @@
+Test for http://bugzilla.opendarwin.org/show_bug.cgi?id=8469 CRASH: WebCore::CSSParser::parseDashboardRegions when attr() is passed.
+
+If the test passes it won't crash
+
+
+
diff --git a/LayoutTests/fast/css/dashboard-regions-attr-crash.html b/LayoutTests/fast/css/dashboard-regions-attr-crash.html
new file mode 100644 (file)
index 0000000..5892dca
--- /dev/null
+++ b/LayoutTests/fast/css/dashboard-regions-attr-crash.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+</head>
+<body>
+<p>Test for <i><a href="http://bugzilla.opendarwin.org/show_bug.cgi?id=8469">http://bugzilla.opendarwin.org/show_bug.cgi?id=8469</a> CRASH: WebCore::CSSParser::parseDashboardRegions when attr() is passed</i>.</p>
+<p>If the test passes it won't crash</p> 
+<br style="-webkit-dashboard-region: dashboard-region("a");">
+<table style="-webkit-dashboard-region: attr("a");">
+</body>
+</html>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 81a9ca31e06605ff64ef82f42e1d086530faba92..74582603e0c42a66fea3a0b62a55ef9d1775d8c8 100644 (file)
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,15 @@
+2006-04-19  Mitz Pettel  <opendarwin.org@mitzpettel.com>
+
+        Reviewed by Eric, landed by ap.
+
+        - fix http://bugzilla.opendarwin.org/show_bug.cgi?id=8469
+          CRASH: WebCore::CSSParser::parseDashboardRegions when attr() is passed
+
+        Test: fast/css/dashboard-regions-attr-crash.html
+
+        * css/cssparser.cpp:
+        (WebCore::CSSParser::parseDashboardRegions): Added null check for args.
+
 2006-04-18  Rob Buis  <buis@kde.org>
 
         Reviewed by eseidel & darin.  Landed by eseidel.
diff --git a/WebCore/css/cssparser.cpp b/WebCore/css/cssparser.cpp
index d65c157677b1b1ab5bdd845e4f96d967eff99a3b..1f783f94b848164efa54fd8e3c696f7fe3daea34 100644 (file)
--- a/WebCore/css/cssparser.cpp
+++ b/WebCore/css/cssparser.cpp
@@ -1796,15 +1796,15 @@ bool CSSParser::parseDashboardRegions(int propId, bool important)
         // dashboard-region(label, type) or dashboard-region(label type)
         // dashboard-region(label, type) or dashboard-region(label type)
         ValueList* args = value->function->args;
-        int numArgs = value->function->args->size();
-        if ((numArgs != DASHBOARD_REGION_NUM_PARAMETERS && numArgs != (DASHBOARD_REGION_NUM_PARAMETERS*2-1)) &&
-            (numArgs != DASHBOARD_REGION_SHORT_NUM_PARAMETERS && numArgs != (DASHBOARD_REGION_SHORT_NUM_PARAMETERS*2-1))){
+        String fname = domString(value->function->name).lower();
+        if (fname != "dashboard-region(" || !args) {
             valid = false;
             break;
         }
         
-        String fname = domString(value->function->name).lower();
-        if (fname != "dashboard-region(") {
+        int numArgs = args->size();
+        if ((numArgs != DASHBOARD_REGION_NUM_PARAMETERS && numArgs != (DASHBOARD_REGION_NUM_PARAMETERS*2-1)) &&
+            (numArgs != DASHBOARD_REGION_SHORT_NUM_PARAMETERS && numArgs != (DASHBOARD_REGION_SHORT_NUM_PARAMETERS*2-1))){
             valid = false;
             break;
         }
Mirror of the WebKit open source project from svn.webkit.org.