<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[172036] trunk</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/172036">172036</a></dd>
<dt>Author</dt> <dd>commit-queue@webkit.org</dd>
<dt>Date</dt> <dd>2014-08-05 11:14:31 -0700 (Tue, 05 Aug 2014)</dd>
</dl>
<h3>Log Message</h3>
<pre>ASSERTION FAILED: name[0] == '@' && length >= 2 in WebCore::CSSParser::detectAtToken
https://bugs.webkit.org/show_bug.cgi?id=134632
Source/WebCore:
At-rules must consist of at least two characters: the '@' symbol followed by
an identifier name. The failure of this condition makes the assertion fail.
The length of an at-rule is currently calculated by pointer arithmetic on
the 'result' pointer, which is expected to be set to the end of the at-rule
identifier by the WebCore::*CSSTokenizer::parseIdentifier method.
If the at-rule token is a sequence of 8-bit-only characters then
'result' will point correctly at the end of the identifier. However, if
the at-rule contains a 16-bit Unicode escape then 'result' will not be
updated correctly anymore, hence it cannot be used for length calculation.
The patch makes the parseIdentifier bump the result pointer even in the 16-bit slow case.
Patch by Renata Hodovan, backported from Chromium: https://codereview.chromium.org/241053002
Patch by Martin Hodovan <mhodovan.u-szeged@partner.samsung.com> on 2014-08-05
Reviewed by Darin Adler.
Test: fast/css/atrule-with-escape-character-crash.html
* css/CSSParser.cpp:
(WebCore::CSSParser::realLex):
LayoutTests:
Added test demonstrates that at-rules containing 16-bit Unicode characters
can be handled properly.
Patch by Martin Hodovan <mhodovan.u-szeged@partner.samsung.com> on 2014-08-05
Reviewed by Darin Adler.
* fast/css/atrule-with-escape-character-crash-expected.txt: Added.
* fast/css/atrule-with-escape-character-crash.html: Added.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorecssCSSParsercpp">trunk/Source/WebCore/css/CSSParser.cpp</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsfastcssatrulewithescapecharactercrashexpectedtxt">trunk/LayoutTests/fast/css/atrule-with-escape-character-crash-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastcssatrulewithescapecharactercrashhtml">trunk/LayoutTests/fast/css/atrule-with-escape-character-crash.html</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (172035 => 172036)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog 2014-08-05 17:49:44 UTC (rev 172035)
+++ trunk/LayoutTests/ChangeLog 2014-08-05 18:14:31 UTC (rev 172036)
</span><span class="lines">@@ -1,3 +1,16 @@
</span><ins>+2014-08-05 Martin Hodovan <mhodovan.u-szeged@partner.samsung.com>
+
+ ASSERTION FAILED: name[0] == '@' && length >= 2 in WebCore::CSSParser::detectAtToken
+ https://bugs.webkit.org/show_bug.cgi?id=134632
+
+ Added test demonstrates that at-rules containing 16-bit Unicode characters
+ can be handled properly.
+
+ Reviewed by Darin Adler.
+
+ * fast/css/atrule-with-escape-character-crash-expected.txt: Added.
+ * fast/css/atrule-with-escape-character-crash.html: Added.
+
</ins><span class="cx"> 2014-08-05 Renata Hodovan <rhodovan.u-szeged@partner.samsung.com>
</span><span class="cx">
</span><span class="cx"> Fixing calc() parameter parsing in cubic-bezier functions
</span></span></pre></div>
<a id="trunkLayoutTestsfastcssatrulewithescapecharactercrashexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/css/atrule-with-escape-character-crash-expected.txt (0 => 172036)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/css/atrule-with-escape-character-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/css/atrule-with-escape-character-crash-expected.txt 2014-08-05 18:14:31 UTC (rev 172036)
</span><span class="lines">@@ -0,0 +1 @@
</span><ins>+Test for crash when the identifier of an at-rule contains unicode escapes. The test passes if it does not cause an assertion failure. [https://bugs.webkit.org/show_bug.cgi?id=134632]
</ins></span></pre></div>
<a id="trunkLayoutTestsfastcssatrulewithescapecharactercrashhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/css/atrule-with-escape-character-crash.html (0 => 172036)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/css/atrule-with-escape-character-crash.html (rev 0)
+++ trunk/LayoutTests/fast/css/atrule-with-escape-character-crash.html 2014-08-05 18:14:31 UTC (rev 172036)
</span><span class="lines">@@ -0,0 +1,22 @@
</span><ins>+<!DOCTYPE html>
+<html>
+<head>
+ <script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+ </script>
+
+ <style>
+ * {
+ @\aaa
+ }
+ </style>
+</head>
+<body>
+ <p>
+ Test for crash when the identifier of an at-rule contains unicode escapes.
+ The test passes if it does not cause an assertion failure.
+ [https://bugs.webkit.org/show_bug.cgi?id=134632]
+ </p>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (172035 => 172036)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog 2014-08-05 17:49:44 UTC (rev 172035)
+++ trunk/Source/WebCore/ChangeLog 2014-08-05 18:14:31 UTC (rev 172036)
</span><span class="lines">@@ -1,3 +1,29 @@
</span><ins>+2014-08-05 Martin Hodovan <mhodovan.u-szeged@partner.samsung.com>
+
+ ASSERTION FAILED: name[0] == '@' && length >= 2 in WebCore::CSSParser::detectAtToken
+ https://bugs.webkit.org/show_bug.cgi?id=134632
+
+ At-rules must consist of at least two characters: the '@' symbol followed by
+ an identifier name. The failure of this condition makes the assertion fail.
+
+ The length of an at-rule is currently calculated by pointer arithmetic on
+ the 'result' pointer, which is expected to be set to the end of the at-rule
+ identifier by the WebCore::*CSSTokenizer::parseIdentifier method.
+ If the at-rule token is a sequence of 8-bit-only characters then
+ 'result' will point correctly at the end of the identifier. However, if
+ the at-rule contains a 16-bit Unicode escape then 'result' will not be
+ updated correctly anymore, hence it cannot be used for length calculation.
+ The patch makes the parseIdentifier bump the result pointer even in the 16-bit slow case.
+
+ Patch by Renata Hodovan, backported from Chromium: https://codereview.chromium.org/241053002
+
+ Reviewed by Darin Adler.
+
+ Test: fast/css/atrule-with-escape-character-crash.html
+
+ * css/CSSParser.cpp:
+ (WebCore::CSSParser::realLex):
+
</ins><span class="cx"> 2014-08-04 Andy Estes <aestes@apple.com>
</span><span class="cx">
</span><span class="cx"> [iOS] The raw bytes of an iWork document's PDF preview are displayed rather than the PDF itself
</span></span></pre></div>
<a id="trunkSourceWebCorecssCSSParsercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/css/CSSParser.cpp (172035 => 172036)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/css/CSSParser.cpp 2014-08-05 17:49:44 UTC (rev 172035)
+++ trunk/Source/WebCore/css/CSSParser.cpp 2014-08-05 18:14:31 UTC (rev 172036)
</span><span class="lines">@@ -10298,6 +10298,7 @@
</span><span class="cx">
</span><span class="cx"> parseIdentifierInternal(currentCharacter<CharacterType>(), result16, hasEscape);
</span><span class="cx">
</span><ins>+ result += result16 - start16;
</ins><span class="cx"> resultString.init(start16, result16 - start16);
</span><span class="cx">
</span><span class="cx"> return;
</span></span></pre>
</div>
</div>
</body>
</html>