From: ap Date: Wed, 19 Apr 2006 16:45:13 +0000 (+0000) Subject: Fix by Mitz Pettel, reviewed by Eric. X-Git-Url: https://git.webkit.org/?p=WebKit-https.git;a=commitdiff_plain;h=afc6600e8b4b2fbe18a230ea4ed33804effd0294 Fix by Mitz Pettel, reviewed by Eric. - fix http://bugzilla.opendarwin.org/show_bug.cgi?id=8469 CRASH: WebCore::CSSParser::parseDashboardRegions when attr() is passed Test: fast/css/dashboard-regions-attr-crash.html * css/cssparser.cpp: (WebCore::CSSParser::parseDashboardRegions): Added null check for args. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@13969 268f45cc-cd09-0410-ab3c-d52691b4dbfc --- diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog index 4471318ab348..9d9773c25adb 100644 --- a/LayoutTests/ChangeLog +++ b/LayoutTests/ChangeLog @@ -1,3 +1,13 @@ +2006-04-19 Mitz Pettel + + Reviewed by Eric, landed by ap. + + - test for http://bugzilla.opendarwin.org/show_bug.cgi?id=8469 + CRASH: WebCore::CSSParser::parseDashboardRegions when attr() is passed + + * fast/css/dashboard-regions-attr-crash-expected.txt + * fast/css/dashboard-regions-attr-crash.html + 2006-04-17 Rob Buis Reviewed by eseidel. Landed by eseidel. diff --git a/LayoutTests/fast/css/dashboard-regions-attr-crash-expected.txt b/LayoutTests/fast/css/dashboard-regions-attr-crash-expected.txt new file mode 100644 index 000000000000..3b819b826d23 --- /dev/null +++ b/LayoutTests/fast/css/dashboard-regions-attr-crash-expected.txt @@ -0,0 +1,6 @@ +Test for http://bugzilla.opendarwin.org/show_bug.cgi?id=8469 CRASH: WebCore::CSSParser::parseDashboardRegions when attr() is passed. + +If the test passes it won't crash + + + diff --git a/LayoutTests/fast/css/dashboard-regions-attr-crash.html b/LayoutTests/fast/css/dashboard-regions-attr-crash.html new file mode 100644 index 000000000000..5892dcaac0a3 --- /dev/null +++ b/LayoutTests/fast/css/dashboard-regions-attr-crash.html @@ -0,0 +1,14 @@ + + + + + +

Test for http://bugzilla.opendarwin.org/show_bug.cgi?id=8469 CRASH: WebCore::CSSParser::parseDashboardRegions when attr() is passed.

If the test passes it won't crash

+
+ + + diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog index 81a9ca31e066..74582603e0c4 100644 --- a/WebCore/ChangeLog +++ b/WebCore/ChangeLog @@ -1,3 +1,15 @@ +2006-04-19 Mitz Pettel + + Reviewed by Eric, landed by ap. + + - fix http://bugzilla.opendarwin.org/show_bug.cgi?id=8469 + CRASH: WebCore::CSSParser::parseDashboardRegions when attr() is passed + + Test: fast/css/dashboard-regions-attr-crash.html + + * css/cssparser.cpp: + (WebCore::CSSParser::parseDashboardRegions): Added null check for args. + 2006-04-18 Rob Buis Reviewed by eseidel & darin. Landed by eseidel. diff --git a/WebCore/css/cssparser.cpp b/WebCore/css/cssparser.cpp index d65c157677b1..1f783f94b848 100644 --- a/WebCore/css/cssparser.cpp +++ b/WebCore/css/cssparser.cpp @@ -1796,15 +1796,15 @@ bool CSSParser::parseDashboardRegions(int propId, bool important) // dashboard-region(label, type) or dashboard-region(label type) // dashboard-region(label, type) or dashboard-region(label type) ValueList* args = value->function->args; - int numArgs = value->function->args->size(); - if ((numArgs != DASHBOARD_REGION_NUM_PARAMETERS && numArgs != (DASHBOARD_REGION_NUM_PARAMETERS*2-1)) && - (numArgs != DASHBOARD_REGION_SHORT_NUM_PARAMETERS && numArgs != (DASHBOARD_REGION_SHORT_NUM_PARAMETERS*2-1))){ + String fname = domString(value->function->name).lower(); + if (fname != "dashboard-region(" || !args) { valid = false; break; } - String fname = domString(value->function->name).lower(); - if (fname != "dashboard-region(") { + int numArgs = args->size(); + if ((numArgs != DASHBOARD_REGION_NUM_PARAMETERS && numArgs != (DASHBOARD_REGION_NUM_PARAMETERS*2-1)) && + (numArgs != DASHBOARD_REGION_SHORT_NUM_PARAMETERS && numArgs != (DASHBOARD_REGION_SHORT_NUM_PARAMETERS*2-1))){ valid = false; break; }