<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[173697] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/173697">173697</a></dd>
<dt>Author</dt> <dd>benjamin@webkit.org</dd>
<dt>Date</dt> <dd>2014-09-17 13:01:09 -0700 (Wed, 17 Sep 2014)</dd>
</dl>

<h3>Log Message</h3>
<pre>CSS value in whitespace-separated list attribute selector (~=) mishandles tab/newline/etc.
https://bugs.webkit.org/show_bug.cgi?id=136807

Patch by Benjamin Poulain &lt;bpoulain@apple.com&gt; on 2014-09-17
Reviewed by Antti Koivisto.

Source/WebCore:

The spec defines selector lists as token separated by white space.

The definition of white space for CSS Selectors is:
&quot;White space in Selectors consists of the code points SPACE (U+0020),
TAB (U+0009), LINE FEED (U+000A), CARRIAGE RETURN (U+000D), and FORM FEED (U+000C)
can occur in whitespace. Other space-like code points, such as EM SPACE (U+2003)
and IDEOGRAPHIC SPACE (U+3000), are never part of white space.&quot;

The old code was only matching SPACE (U+0020) which is buggy. This patch
adds support for the other caracters.

Tests: fast/selectors/attr-list-01.html
       fast/selectors/attribute-list-with-whitespace-in-selector.html
       fast/selectors/attribute-list-with-whitespace-in-value.html

* css/SelectorChecker.cpp:
(WebCore::attributeValueMatches):
* cssjit/SelectorCompiler.cpp:
(WebCore::SelectorCompiler::constructFragments):
(WebCore::SelectorCompiler::attributeValueSpaceSeparetedListContains):
Add the missing checks.

* html/track/VTTRegion.cpp:
(WebCore::VTTRegion::setRegionSettings):
(WebCore::VTTRegion::parseSettingValue):
* html/track/WebVTTParser.cpp:
(WebCore::WebVTTParser::hasRequiredFileIdentifier):
(WebCore::WebVTTParser::collectTimingsAndSettings):
* html/track/WebVTTParser.h:
While looking for affected code, I discovered WebVTT redefines isHTMLSpace().
I cleaned that code.

Source/WTF:

* wtf/text/AtomicString.h:
(WTF::AtomicString::find):

LayoutTests:

* fast/selectors/attr-list-01-expected.html: Added.
* fast/selectors/attr-list-01.html: Added.
This test is from a similar fix from Opera for the blink fork.
Review URL: https://chromiumcodereview.appspot.com/14980012
No other part of that patch is included.

* fast/selectors/attribute-list-with-whitespace-in-selector-expected.txt: Added.
* fast/selectors/attribute-list-with-whitespace-in-selector.html: Added.
Test whitespace characters in the selector itself.

* fast/selectors/attribute-list-with-whitespace-in-value-expected.txt: Added.
* fast/selectors/attribute-list-with-whitespace-in-value.html: Added.
Test whitespace characters in the attribute value.</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkSourceWTFChangeLog">trunk/Source/WTF/ChangeLog</a></li>
<li><a href="#trunkSourceWTFwtftextAtomicStringh">trunk/Source/WTF/wtf/text/AtomicString.h</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorecssSelectorCheckercpp">trunk/Source/WebCore/css/SelectorChecker.cpp</a></li>
<li><a href="#trunkSourceWebCorecssjitSelectorCompilercpp">trunk/Source/WebCore/cssjit/SelectorCompiler.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmltrackVTTRegioncpp">trunk/Source/WebCore/html/track/VTTRegion.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmltrackWebVTTParsercpp">trunk/Source/WebCore/html/track/WebVTTParser.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmltrackWebVTTParserh">trunk/Source/WebCore/html/track/WebVTTParser.h</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsfastselectorsattrlist01expectedhtml">trunk/LayoutTests/fast/selectors/attr-list-01-expected.html</a></li>
<li><a href="#trunkLayoutTestsfastselectorsattrlist01html">trunk/LayoutTests/fast/selectors/attr-list-01.html</a></li>
<li><a href="#trunkLayoutTestsfastselectorsattributelistwithwhitespaceinselectorexpectedtxt">trunk/LayoutTests/fast/selectors/attribute-list-with-whitespace-in-selector-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastselectorsattributelistwithwhitespaceinselectorhtml">trunk/LayoutTests/fast/selectors/attribute-list-with-whitespace-in-selector.html</a></li>
<li><a href="#trunkLayoutTestsfastselectorsattributelistwithwhitespaceinvalueexpectedtxt">trunk/LayoutTests/fast/selectors/attribute-list-with-whitespace-in-value-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastselectorsattributelistwithwhitespaceinvaluehtml">trunk/LayoutTests/fast/selectors/attribute-list-with-whitespace-in-value.html</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (173696 => 173697)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog        2014-09-17 18:27:42 UTC (rev 173696)
+++ trunk/LayoutTests/ChangeLog        2014-09-17 20:01:09 UTC (rev 173697)
</span><span class="lines">@@ -1,3 +1,24 @@
</span><ins>+2014-09-17  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
+
+        CSS value in whitespace-separated list attribute selector (~=) mishandles tab/newline/etc.
+        https://bugs.webkit.org/show_bug.cgi?id=136807
+
+        Reviewed by Antti Koivisto.
+
+        * fast/selectors/attr-list-01-expected.html: Added.
+        * fast/selectors/attr-list-01.html: Added.
+        This test is from a similar fix from Opera for the blink fork.
+        Review URL: https://chromiumcodereview.appspot.com/14980012
+        No other part of that patch is included.
+
+        * fast/selectors/attribute-list-with-whitespace-in-selector-expected.txt: Added.
+        * fast/selectors/attribute-list-with-whitespace-in-selector.html: Added.
+        Test whitespace characters in the selector itself.
+
+        * fast/selectors/attribute-list-with-whitespace-in-value-expected.txt: Added.
+        * fast/selectors/attribute-list-with-whitespace-in-value.html: Added.
+        Test whitespace characters in the attribute value.
+
</ins><span class="cx"> 2014-09-16  Yusuke Suzuki  &lt;utatane.tea@gmail.com&gt;
</span><span class="cx"> 
</span><span class="cx">         filterRootById accidentally clears inAdjacentChain flag
</span></span></pre></div>
<a id="trunkLayoutTestsfastselectorsattrlist01expectedhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/selectors/attr-list-01-expected.html (0 => 173697)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/selectors/attr-list-01-expected.html                                (rev 0)
+++ trunk/LayoutTests/fast/selectors/attr-list-01-expected.html        2014-09-17 20:01:09 UTC (rev 173697)
</span><span class="lines">@@ -0,0 +1,2 @@
</span><ins>+&lt;!DOCTYPE html&gt;
+&lt;p style=&quot;color:green&quot;&gt;This text should be green&lt;/span&gt;
</ins></span></pre></div>
<a id="trunkLayoutTestsfastselectorsattrlist01html"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/selectors/attr-list-01.html (0 => 173697)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/selectors/attr-list-01.html                                (rev 0)
+++ trunk/LayoutTests/fast/selectors/attr-list-01.html        2014-09-17 20:01:09 UTC (rev 173697)
</span><span class="lines">@@ -0,0 +1,21 @@
</span><ins>+&lt;!DOCTYPE html&gt;
+&lt;html&gt;
+  &lt;head&gt;
+    &lt;title&gt;Whitespace-separated attribute selectors&lt;/title&gt;
+    &lt;style&gt;
+      span { color: red; }
+      [data-list~=&quot;b&quot;] { color: green; }
+      #t1:not([data-list~=&quot; z&quot;]) { color: green; }
+      #t2:not([data-list~=&quot;u        &quot;]) { color: green; }
+    &lt;/style&gt;
+  &lt;/head&gt;
+  &lt;body&gt;
+    &lt;p&gt;
+      &lt;span data-list=&quot;a        b        &quot;&gt;This&lt;/span&gt;
+      &lt;span data-list=&quot;a&amp;#10;b&amp;#13;c&quot;&gt;text&lt;/span&gt;
+      &lt;span data-list=&quot;a   &amp;#12;b &amp;#12;&quot;&gt;should&lt;/span&gt;
+      &lt;span id=&quot;t1&quot; data-list=&quot;w  z x&amp;#09;&quot;&gt;be&lt;/span&gt;
+      &lt;span id=&quot;t2&quot; data-list=&quot;u&amp;#09;&quot;&gt;green&lt;/span&gt;
+    &lt;/p&gt;
+  &lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="trunkLayoutTestsfastselectorsattributelistwithwhitespaceinselectorexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/selectors/attribute-list-with-whitespace-in-selector-expected.txt (0 => 173697)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/selectors/attribute-list-with-whitespace-in-selector-expected.txt                                (rev 0)
+++ trunk/LayoutTests/fast/selectors/attribute-list-with-whitespace-in-selector-expected.txt        2014-09-17 20:01:09 UTC (rev 173697)
</span><span class="lines">@@ -0,0 +1,73 @@
</span><ins>+When performing attribute matching for space separated values (e.g. [attr~=value]), the selector cannot match anything if the selector's &quot;value&quot; contains a white space. This test check this is true for all the definitions of whitespace of the spec.
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+PASS document.querySelectorAll('[attr~=&quot;&quot;]').length is 0
+PASS hasElementStyledBySelector() is false
+PASS document.querySelectorAll('[attr~=&quot; &quot;]').length is 0
+PASS hasElementStyledBySelector() is false
+PASS document.querySelectorAll('[attr~=&quot;value &quot;]').length is 0
+PASS hasElementStyledBySelector() is false
+PASS document.querySelectorAll('[attr~=&quot; value&quot;]').length is 0
+PASS hasElementStyledBySelector() is false
+PASS document.querySelectorAll('[attr~=&quot; value &quot;]').length is 0
+PASS hasElementStyledBySelector() is false
+PASS document.querySelectorAll('[attr~=&quot;        &quot;]').length is 0
+PASS hasElementStyledBySelector() is false
+PASS document.querySelectorAll('[attr~=&quot;value        &quot;]').length is 0
+PASS hasElementStyledBySelector() is false
+PASS document.querySelectorAll('[attr~=&quot;        value&quot;]').length is 0
+PASS hasElementStyledBySelector() is false
+PASS document.querySelectorAll('[attr~=&quot;        value        &quot;]').length is 0
+PASS hasElementStyledBySelector() is false
+PASS document.querySelectorAll('[attr~=&quot;\\0a&quot;]').length is 0
+PASS hasElementStyledBySelector() is false
+PASS document.querySelectorAll('[attr~=&quot;\\0a &quot;]').length is 0
+PASS hasElementStyledBySelector() is false
+PASS document.querySelectorAll('[attr~=&quot;value\\0a&quot;]').length is 0
+PASS hasElementStyledBySelector() is false
+PASS document.querySelectorAll('[attr~=&quot;\\0a value&quot;]').length is 0
+PASS hasElementStyledBySelector() is false
+PASS document.querySelectorAll('[attr~=&quot;\\0a value\\0a&quot;]').length is 0
+PASS hasElementStyledBySelector() is false
+PASS document.querySelectorAll('[attr~=&quot;\\0d&quot;]').length is 0
+PASS hasElementStyledBySelector() is false
+PASS document.querySelectorAll('[attr~=&quot;\\0d &quot;]').length is 0
+PASS hasElementStyledBySelector() is false
+PASS document.querySelectorAll('[attr~=&quot;value\\0d&quot;]').length is 0
+PASS hasElementStyledBySelector() is false
+PASS document.querySelectorAll('[attr~=&quot;\\0d value&quot;]').length is 0
+PASS hasElementStyledBySelector() is false
+PASS document.querySelectorAll('[attr~=&quot;\\0d value\\0d&quot;]').length is 0
+PASS hasElementStyledBySelector() is false
+PASS document.querySelectorAll('[attr~=&quot;\\0c&quot;]').length is 0
+PASS hasElementStyledBySelector() is false
+PASS document.querySelectorAll('[attr~=&quot;\\0c &quot;]').length is 0
+PASS hasElementStyledBySelector() is false
+PASS document.querySelectorAll('[attr~=&quot;value\\0c&quot;]').length is 0
+PASS hasElementStyledBySelector() is false
+PASS document.querySelectorAll('[attr~=&quot;\\0c value&quot;]').length is 0
+PASS hasElementStyledBySelector() is false
+PASS document.querySelectorAll('[attr~=&quot;\\0c value\\0c&quot;]').length is 0
+PASS hasElementStyledBySelector() is false
+PASS document.querySelectorAll('[attr~=&quot;\\002003&quot;]').length is 1
+PASS hasElementStyledBySelector() is true
+PASS document.querySelectorAll('[attr~=&quot;value\\002003&quot;]').length is 1
+PASS hasElementStyledBySelector() is true
+PASS document.querySelectorAll('[attr~=&quot;\\002003 value&quot;]').length is 1
+PASS hasElementStyledBySelector() is true
+PASS document.querySelectorAll('[attr~=&quot;\\002003 value\\002003&quot;]').length is 1
+PASS hasElementStyledBySelector() is true
+PASS document.querySelectorAll('[attr~=&quot;\\003000&quot;]').length is 1
+PASS hasElementStyledBySelector() is true
+PASS document.querySelectorAll('[attr~=&quot;value\\003000&quot;]').length is 1
+PASS hasElementStyledBySelector() is true
+PASS document.querySelectorAll('[attr~=&quot;\\003000 value&quot;]').length is 1
+PASS hasElementStyledBySelector() is true
+PASS document.querySelectorAll('[attr~=&quot;\\003000 value\\003000&quot;]').length is 1
+PASS hasElementStyledBySelector() is true
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsfastselectorsattributelistwithwhitespaceinselectorhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/selectors/attribute-list-with-whitespace-in-selector.html (0 => 173697)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/selectors/attribute-list-with-whitespace-in-selector.html                                (rev 0)
+++ trunk/LayoutTests/fast/selectors/attribute-list-with-whitespace-in-selector.html        2014-09-17 20:01:09 UTC (rev 173697)
</span><span class="lines">@@ -0,0 +1,154 @@
</span><ins>+&lt;!doctype html&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;style id=&quot;style-container&quot;&gt;
+&lt;/style&gt;
+&lt;/head&gt;
+&lt;body&gt;
+    &lt;div style=&quot;display:none&quot;&gt;
+        &lt;!-- Empty --&gt;
+        &lt;target attr=&quot; &quot;&gt;&lt;/target&gt;
+
+        &lt;!-- Regular spaces. --&gt;
+        &lt;target attr=&quot;value&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot; value&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot;value &quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot; value &quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot; value value value &quot;&gt;&lt;/target&gt;
+
+        &lt;!-- Tabs. --&gt;
+        &lt;target attr=&quot;&amp;#9;&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot;&amp;#9;value&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot;value&amp;#9;&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot;&amp;#9;value&amp;#9;&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot;&amp;#9;value&amp;#9;value&amp;#9;value&amp;#9;&quot;&gt;&lt;/target&gt;
+
+        &lt;!-- Line feed. --&gt;
+        &lt;target attr=&quot;&amp;#10;&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot;&amp;#10;value&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot;value&amp;#10;&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot;&amp;#10;value&amp;#10;&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot;&amp;#10;value&amp;#10;value&amp;#10;value&amp;#10;&quot;&gt;&lt;/target&gt;
+
+        &lt;!-- Carriage return. --&gt;
+        &lt;target attr=&quot;&amp;#13;&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot;&amp;#13;value&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot;value&amp;#13;&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot;&amp;#13;value&amp;#13;&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot;&amp;#13;value&amp;#13;value&amp;#13;value&amp;#13;&quot;&gt;&lt;/target&gt;
+
+        &lt;!-- Carriage return. --&gt;
+        &lt;target attr=&quot;&amp;#12;&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot;&amp;#12;value&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot;value&amp;#12;&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot;&amp;#12;value&amp;#12;&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot;&amp;#12;value&amp;#12;value&amp;#12;value&amp;#12;&quot;&gt;&lt;/target&gt;
+
+        &lt;!-- The spec explicitely says EM SPACE (U+2003) and IDEOGRAPHIC SPACE (U+3000) are not whitespace. Let's test for that. --&gt;
+        &lt;!-- EM SPACE (U+2003). --&gt;
+        &lt;target attr=&quot;&amp;#x2003&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot;&amp;#x2003value&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot;value&amp;#x2003&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot;&amp;#x2003value&amp;#x2003&quot;&gt;&lt;/target&gt;
+
+        &lt;!-- IDEOGRAPHIC SPACE (U+3000). --&gt;
+        &lt;target attr=&quot;&amp;#x3000&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot;&amp;#x3000value&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot;value&amp;#x3000&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot;&amp;#x3000value&amp;#x3000&quot;&gt;&lt;/target&gt;
+    &lt;/div&gt;
+&lt;/body&gt;
+&lt;script&gt;
+description('When performing attribute matching for space separated values (e.g. [attr~=value]), the selector cannot match anything if the selector\'s &quot;value&quot; contains a white space. This test check this is true for all the definitions of whitespace of the spec.');
+
+function hasElementStyledBySelector()
+{
+    var allElements = document.querySelectorAll(&quot;*&quot;);
+    for (var i = 0; i &lt; allElements.length; ++i) {
+        if (getComputedStyle(allElements[i]).backgroundColor == &quot;rgb(1, 2, 3)&quot;)
+            return true;
+    }
+    return false;
+}
+
+function testInvalidSelector(selectorString) {
+    shouldBe('document.querySelectorAll(\'' + selectorString.replace(/\\/g, '\\\\') + '\').length', '0');
+
+    var styleContainer = document.getElementById('style-container');
+    styleContainer.innerHTML = '' + selectorString + ' { background-color: rgb(1, 2, 3); }';
+
+    shouldBeFalse(&quot;hasElementStyledBySelector()&quot;);
+    styleContainer.innerHTML = '';
+}
+
+var invalidValues = [
+    // Empty.
+    '[attr~=&quot;&quot;]',
+
+    // Regular whitespace.
+    '[attr~=&quot; &quot;]',
+    '[attr~=&quot;value &quot;]',
+    '[attr~=&quot; value&quot;]',
+    '[attr~=&quot; value &quot;]',
+
+    // Tab.
+    '[attr~=&quot;\t&quot;]',
+    '[attr~=&quot;value\t&quot;]',
+    '[attr~=&quot;\tvalue&quot;]',
+    '[attr~=&quot;\tvalue\t&quot;]',
+
+    // Line feed.
+    '[attr~=&quot;\\0a&quot;]',
+    '[attr~=&quot;\\0a &quot;]',
+    '[attr~=&quot;value\\0a&quot;]',
+    '[attr~=&quot;\\0a value&quot;]',
+    '[attr~=&quot;\\0a value\\0a&quot;]',
+
+    // Carriage return.
+    '[attr~=&quot;\\0d&quot;]',
+    '[attr~=&quot;\\0d &quot;]',
+    '[attr~=&quot;value\\0d&quot;]',
+    '[attr~=&quot;\\0d value&quot;]',
+    '[attr~=&quot;\\0d value\\0d&quot;]',
+
+    // Form feed.
+    '[attr~=&quot;\\0c&quot;]',
+    '[attr~=&quot;\\0c &quot;]',
+    '[attr~=&quot;value\\0c&quot;]',
+    '[attr~=&quot;\\0c value&quot;]',
+    '[attr~=&quot;\\0c value\\0c&quot;]',
+];
+
+for (var i = 0; i &lt; invalidValues.length; ++i)
+    testInvalidSelector(invalidValues[i]);
+
+var validValues = [
+    // EM SPACE.
+    '[attr~=&quot;\\002003&quot;]',
+    '[attr~=&quot;value\\002003&quot;]',
+    '[attr~=&quot;\\002003 value&quot;]',
+    '[attr~=&quot;\\002003 value\\002003&quot;]',
+
+    // IDEOGRAPHIC SPACE.
+    '[attr~=&quot;\\003000&quot;]',
+    '[attr~=&quot;value\\003000&quot;]',
+    '[attr~=&quot;\\003000 value&quot;]',
+    '[attr~=&quot;\\003000 value\\003000&quot;]',
+];
+
+function testValidSelector(selectorString) {
+    shouldBe('document.querySelectorAll(\'' + selectorString.replace(/\\/g, '\\\\') + '\').length', '1');
+
+    var styleContainer = document.getElementById('style-container');
+    styleContainer.innerHTML = '' + selectorString + ' { background-color: rgb(1, 2, 3); }';
+
+    shouldBeTrue(&quot;hasElementStyledBySelector()&quot;);
+    styleContainer.innerHTML = '';
+}
+
+for (var i = 0; i &lt; validValues.length; ++i)
+    testValidSelector(validValues[i]);
+&lt;/script&gt;
+&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="trunkLayoutTestsfastselectorsattributelistwithwhitespaceinvalueexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/selectors/attribute-list-with-whitespace-in-value-expected.txt (0 => 173697)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/selectors/attribute-list-with-whitespace-in-value-expected.txt                                (rev 0)
+++ trunk/LayoutTests/fast/selectors/attribute-list-with-whitespace-in-value-expected.txt        2014-09-17 20:01:09 UTC (rev 173697)
</span><span class="lines">@@ -0,0 +1,69 @@
</span><ins>+When matching space separated tokens with the attribute selector [attr~=value], any of the following characters can be used as space separator: SPACE (U+0020), TAB (U+0009), LINE FEED (U+000A), CARRIAGE RETURN (U+000D), and FORM FEED (U+000C).
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+PASS document.querySelectorAll(&quot;[attr~=value]&quot;).length is document.querySelectorAll(&quot;target&quot;).length
+PASS document.querySelectorAll(&quot;[attr~=value]&quot;).length is 21
+PASS document.querySelectorAll(&quot;[attr~=value]&quot;)[0].tagName is &quot;TARGET&quot;
+PASS document.querySelectorAll(&quot;[attr~=value]&quot;)[1].tagName is &quot;TARGET&quot;
+PASS document.querySelectorAll(&quot;[attr~=value]&quot;)[2].tagName is &quot;TARGET&quot;
+PASS document.querySelectorAll(&quot;[attr~=value]&quot;)[3].tagName is &quot;TARGET&quot;
+PASS document.querySelectorAll(&quot;[attr~=value]&quot;)[4].tagName is &quot;TARGET&quot;
+PASS document.querySelectorAll(&quot;[attr~=value]&quot;)[5].tagName is &quot;TARGET&quot;
+PASS document.querySelectorAll(&quot;[attr~=value]&quot;)[6].tagName is &quot;TARGET&quot;
+PASS document.querySelectorAll(&quot;[attr~=value]&quot;)[7].tagName is &quot;TARGET&quot;
+PASS document.querySelectorAll(&quot;[attr~=value]&quot;)[8].tagName is &quot;TARGET&quot;
+PASS document.querySelectorAll(&quot;[attr~=value]&quot;)[9].tagName is &quot;TARGET&quot;
+PASS document.querySelectorAll(&quot;[attr~=value]&quot;)[10].tagName is &quot;TARGET&quot;
+PASS document.querySelectorAll(&quot;[attr~=value]&quot;)[11].tagName is &quot;TARGET&quot;
+PASS document.querySelectorAll(&quot;[attr~=value]&quot;)[12].tagName is &quot;TARGET&quot;
+PASS document.querySelectorAll(&quot;[attr~=value]&quot;)[13].tagName is &quot;TARGET&quot;
+PASS document.querySelectorAll(&quot;[attr~=value]&quot;)[14].tagName is &quot;TARGET&quot;
+PASS document.querySelectorAll(&quot;[attr~=value]&quot;)[15].tagName is &quot;TARGET&quot;
+PASS document.querySelectorAll(&quot;[attr~=value]&quot;)[16].tagName is &quot;TARGET&quot;
+PASS document.querySelectorAll(&quot;[attr~=value]&quot;)[17].tagName is &quot;TARGET&quot;
+PASS document.querySelectorAll(&quot;[attr~=value]&quot;)[18].tagName is &quot;TARGET&quot;
+PASS document.querySelectorAll(&quot;[attr~=value]&quot;)[19].tagName is &quot;TARGET&quot;
+PASS document.querySelectorAll(&quot;[attr~=value]&quot;)[20].tagName is &quot;TARGET&quot;
+PASS getComputedStyle(document.querySelectorAll(&quot;#testBlock *&quot;)[0]).backgroundColor is &quot;rgb(1, 2, 3)&quot;
+PASS getComputedStyle(document.querySelectorAll(&quot;#testBlock *&quot;)[1]).backgroundColor is &quot;rgb(1, 2, 3)&quot;
+PASS getComputedStyle(document.querySelectorAll(&quot;#testBlock *&quot;)[2]).backgroundColor is &quot;rgb(1, 2, 3)&quot;
+PASS getComputedStyle(document.querySelectorAll(&quot;#testBlock *&quot;)[3]).backgroundColor is &quot;rgb(1, 2, 3)&quot;
+PASS getComputedStyle(document.querySelectorAll(&quot;#testBlock *&quot;)[4]).backgroundColor is &quot;rgb(1, 2, 3)&quot;
+PASS getComputedStyle(document.querySelectorAll(&quot;#testBlock *&quot;)[5]).backgroundColor is &quot;rgb(0, 0, 0)&quot;
+PASS getComputedStyle(document.querySelectorAll(&quot;#testBlock *&quot;)[6]).backgroundColor is &quot;rgb(1, 2, 3)&quot;
+PASS getComputedStyle(document.querySelectorAll(&quot;#testBlock *&quot;)[7]).backgroundColor is &quot;rgb(1, 2, 3)&quot;
+PASS getComputedStyle(document.querySelectorAll(&quot;#testBlock *&quot;)[8]).backgroundColor is &quot;rgb(1, 2, 3)&quot;
+PASS getComputedStyle(document.querySelectorAll(&quot;#testBlock *&quot;)[9]).backgroundColor is &quot;rgb(1, 2, 3)&quot;
+PASS getComputedStyle(document.querySelectorAll(&quot;#testBlock *&quot;)[10]).backgroundColor is &quot;rgb(0, 0, 0)&quot;
+PASS getComputedStyle(document.querySelectorAll(&quot;#testBlock *&quot;)[11]).backgroundColor is &quot;rgb(1, 2, 3)&quot;
+PASS getComputedStyle(document.querySelectorAll(&quot;#testBlock *&quot;)[12]).backgroundColor is &quot;rgb(1, 2, 3)&quot;
+PASS getComputedStyle(document.querySelectorAll(&quot;#testBlock *&quot;)[13]).backgroundColor is &quot;rgb(1, 2, 3)&quot;
+PASS getComputedStyle(document.querySelectorAll(&quot;#testBlock *&quot;)[14]).backgroundColor is &quot;rgb(1, 2, 3)&quot;
+PASS getComputedStyle(document.querySelectorAll(&quot;#testBlock *&quot;)[15]).backgroundColor is &quot;rgb(0, 0, 0)&quot;
+PASS getComputedStyle(document.querySelectorAll(&quot;#testBlock *&quot;)[16]).backgroundColor is &quot;rgb(1, 2, 3)&quot;
+PASS getComputedStyle(document.querySelectorAll(&quot;#testBlock *&quot;)[17]).backgroundColor is &quot;rgb(1, 2, 3)&quot;
+PASS getComputedStyle(document.querySelectorAll(&quot;#testBlock *&quot;)[18]).backgroundColor is &quot;rgb(1, 2, 3)&quot;
+PASS getComputedStyle(document.querySelectorAll(&quot;#testBlock *&quot;)[19]).backgroundColor is &quot;rgb(1, 2, 3)&quot;
+PASS getComputedStyle(document.querySelectorAll(&quot;#testBlock *&quot;)[20]).backgroundColor is &quot;rgb(0, 0, 0)&quot;
+PASS getComputedStyle(document.querySelectorAll(&quot;#testBlock *&quot;)[21]).backgroundColor is &quot;rgb(1, 2, 3)&quot;
+PASS getComputedStyle(document.querySelectorAll(&quot;#testBlock *&quot;)[22]).backgroundColor is &quot;rgb(1, 2, 3)&quot;
+PASS getComputedStyle(document.querySelectorAll(&quot;#testBlock *&quot;)[23]).backgroundColor is &quot;rgb(1, 2, 3)&quot;
+PASS getComputedStyle(document.querySelectorAll(&quot;#testBlock *&quot;)[24]).backgroundColor is &quot;rgb(1, 2, 3)&quot;
+PASS getComputedStyle(document.querySelectorAll(&quot;#testBlock *&quot;)[25]).backgroundColor is &quot;rgb(0, 0, 0)&quot;
+PASS getComputedStyle(document.querySelectorAll(&quot;#testBlock *&quot;)[26]).backgroundColor is &quot;rgb(0, 0, 0)&quot;
+PASS getComputedStyle(document.querySelectorAll(&quot;#testBlock *&quot;)[27]).backgroundColor is &quot;rgb(0, 0, 0)&quot;
+PASS getComputedStyle(document.querySelectorAll(&quot;#testBlock *&quot;)[28]).backgroundColor is &quot;rgb(0, 0, 0)&quot;
+PASS getComputedStyle(document.querySelectorAll(&quot;#testBlock *&quot;)[29]).backgroundColor is &quot;rgb(0, 0, 0)&quot;
+PASS getComputedStyle(document.querySelectorAll(&quot;#testBlock *&quot;)[30]).backgroundColor is &quot;rgb(0, 0, 0)&quot;
+PASS getComputedStyle(document.querySelectorAll(&quot;#testBlock *&quot;)[31]).backgroundColor is &quot;rgb(0, 0, 0)&quot;
+PASS getComputedStyle(document.querySelectorAll(&quot;#testBlock *&quot;)[32]).backgroundColor is &quot;rgb(0, 0, 0)&quot;
+PASS getComputedStyle(document.querySelectorAll(&quot;#testBlock *&quot;)[33]).backgroundColor is &quot;rgb(0, 0, 0)&quot;
+PASS getComputedStyle(document.querySelectorAll(&quot;#testBlock *&quot;)[34]).backgroundColor is &quot;rgb(0, 0, 0)&quot;
+PASS document.querySelectorAll(&quot;[attr~=\\002003 value]&quot;).length is 2
+PASS document.querySelectorAll(&quot;[attr~=\\002003 value\\003000]&quot;).length is 1
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsfastselectorsattributelistwithwhitespaceinvaluehtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/selectors/attribute-list-with-whitespace-in-value.html (0 => 173697)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/selectors/attribute-list-with-whitespace-in-value.html                                (rev 0)
+++ trunk/LayoutTests/fast/selectors/attribute-list-with-whitespace-in-value.html        2014-09-17 20:01:09 UTC (rev 173697)
</span><span class="lines">@@ -0,0 +1,89 @@
</span><ins>+&lt;!doctype html&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;style&gt;
+#testBlock * {
+    background-color: black;
+}
+#testBlock [attr~=value] {
+    background-color: rgb(1, 2, 3);
+}
+&lt;/style&gt;
+&lt;/head&gt;
+&lt;body&gt;
+    &lt;div style=&quot;display:none&quot; id=&quot;testBlock&quot;&gt;
+        &lt;target attr=&quot;value&quot;&gt;&lt;/target&gt;
+
+        &lt;!-- Regular spaces. --&gt;
+        &lt;target attr=&quot; value&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot;value &quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot; value &quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot; value value value &quot;&gt;&lt;/target&gt;
+
+        &lt;!-- Tabs. --&gt;
+        &lt;invalidTarget attr=&quot;&amp;#9;&quot;&gt;&lt;/invalidTarget&gt;
+        &lt;target attr=&quot;&amp;#9;value&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot;value&amp;#9;&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot;&amp;#9;value&amp;#9;&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot;&amp;#9;value1&amp;#9;value&amp;#9;value3&amp;#9;&quot;&gt;&lt;/target&gt;
+
+        &lt;!-- Line feed. --&gt;
+        &lt;invalidTarget attr=&quot;&amp;#10;&quot;&gt;&lt;/invalidTarget&gt;
+        &lt;target attr=&quot;&amp;#10;value&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot;value&amp;#10;&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot;&amp;#10;value&amp;#10;&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot;&amp;#10;value1&amp;#10;value&amp;#10;value3&amp;#10;&quot;&gt;&lt;/target&gt;
+
+        &lt;!-- Carriage return. --&gt;
+        &lt;invalidTarget attr=&quot;&amp;#13;&quot;&gt;&lt;/invalidTarget&gt;
+        &lt;target attr=&quot;&amp;#13;value&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot;value&amp;#13;&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot;&amp;#13;value&amp;#13;&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot;&amp;#13;value1&amp;#13;value&amp;#13;value3&amp;#13;&quot;&gt;&lt;/target&gt;
+
+        &lt;!-- Carriage return. --&gt;
+        &lt;invalidTarget attr=&quot;&amp;#12;&quot;&gt;&lt;/invalidTarget&gt;
+        &lt;target attr=&quot;&amp;#12;value&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot;value&amp;#12;&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot;&amp;#12;value&amp;#12;&quot;&gt;&lt;/target&gt;
+        &lt;target attr=&quot;&amp;#12;value1&amp;#12;value&amp;#12;value3&amp;#12;&quot;&gt;&lt;/target&gt;
+
+        &lt;!-- The spec explicitely says EM SPACE (U+2003) and IDEOGRAPHIC SPACE (U+3000) are not whitespace. Let's test for that. --&gt;
+        &lt;!-- EM SPACE (U+2003). --&gt;
+        &lt;invalidTarget attr=&quot;&amp;#x2003&quot;&gt;&lt;/invalidTarget&gt;
+        &lt;emSpaceTarget attr=&quot;&amp;#x2003value&quot;&gt;&lt;/emSpaceTarget&gt;
+        &lt;invalidTarget attr=&quot;value&amp;#x2003&quot;&gt;&lt;/invalidTarget&gt;
+        &lt;invalidTarget attr=&quot;&amp;#x2003value1&amp;#x2003value&amp;#x2003value3&amp;#x2003&quot;&gt;&lt;/invalidTarget&gt;
+        &lt;emSpaceTarget attr=&quot;&amp;#x2003value1 &amp;#x2003value2&amp;#9;&amp;#x2003value3&amp;#10;&amp;#x2003value4&amp;#13;&amp;#x2003value5&amp;#12;&amp;#x2003value&quot;&gt;&lt;/emSpaceTarget&gt;
+
+        &lt;!-- IDEOGRAPHIC SPACE (U+3000). --&gt;
+        &lt;invalidTarget attr=&quot;&amp;#x3000&quot;&gt;&lt;/invalidTarget&gt;
+        &lt;invalidTarget attr=&quot;&amp;#x3000value&quot;&gt;&lt;/invalidTarget&gt;
+        &lt;invalidTarget attr=&quot;value&amp;#x3000&quot;&gt;&lt;/invalidTarget&gt;
+        &lt;invalidTarget attr=&quot;&amp;#x3000value1&amp;#x3000value&amp;#x3000value3&amp;#x3000&quot;&gt;&lt;/invalidTarget&gt;
+        &lt;ideographicSpaceTarget attr=&quot;&amp;#x2003value1&amp;#x3000 &amp;#x2003value2&amp;#x3000&amp;#9;&amp;#x2003value3&amp;#x3000&amp;#10;&amp;#x2003value4&amp;#x3000&amp;#13;&amp;#x2003value5&amp;#x3000&amp;#12;&amp;#x2003value&amp;#x3000&quot;&gt;&lt;/ideographicSpaceTarget&gt;
+    &lt;/div&gt;
+&lt;/body&gt;
+&lt;script&gt;
+description('When matching space separated tokens with the attribute selector [attr~=value], any of the following characters can be used as space separator: SPACE (U+0020), TAB (U+0009), LINE FEED (U+000A), CARRIAGE RETURN (U+000D), and FORM FEED (U+000C).');
+
+shouldBe('document.querySelectorAll(&quot;[attr~=value]&quot;).length', 'document.querySelectorAll(&quot;target&quot;).length');
+shouldBe('document.querySelectorAll(&quot;[attr~=value]&quot;).length', '' + document.querySelectorAll(&quot;target&quot;).length); // For result readability.
+
+// Test querySelector.
+var allMatches = document.querySelectorAll(&quot;[attr~=value]&quot;);
+for (var i = 0; i &lt; allMatches.length; ++i)
+    shouldBeEqualToString('document.querySelectorAll(&quot;[attr~=value]&quot;)[' + i + '].tagName', 'TARGET');
+
+// Test styling.
+var allTestElements = document.querySelectorAll(&quot;#testBlock *&quot;);
+for (var i = 0; i &lt; allTestElements.length; ++i)
+    shouldBeEqualToString('getComputedStyle(document.querySelectorAll(&quot;#testBlock *&quot;)[' + i + ']).backgroundColor', allTestElements[i].tagName === 'TARGET' ? 'rgb(1, 2, 3)' : 'rgb(0, 0, 0)');
+
+// Make sure neither EM SPACE nor IDEOGRAPHIC SPACE get a special value.
+shouldBe('document.querySelectorAll(&quot;[attr~=\\\\002003 value]&quot;).length', '2');
+shouldBe('document.querySelectorAll(&quot;[attr~=\\\\002003 value\\\\003000]&quot;).length', '1');
+&lt;/script&gt;
+&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="trunkSourceWTFChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WTF/ChangeLog (173696 => 173697)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WTF/ChangeLog        2014-09-17 18:27:42 UTC (rev 173696)
+++ trunk/Source/WTF/ChangeLog        2014-09-17 20:01:09 UTC (rev 173697)
</span><span class="lines">@@ -1,3 +1,13 @@
</span><ins>+2014-09-17  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
+
+        CSS value in whitespace-separated list attribute selector (~=) mishandles tab/newline/etc.
+        https://bugs.webkit.org/show_bug.cgi?id=136807
+
+        Reviewed by Antti Koivisto.
+
+        * wtf/text/AtomicString.h:
+        (WTF::AtomicString::find):
+
</ins><span class="cx"> 2014-09-17  Daniel Bates  &lt;dabates@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         [iOS] Make WebCore build with public iOS SDK
</span></span></pre></div>
<a id="trunkSourceWTFwtftextAtomicStringh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WTF/wtf/text/AtomicString.h (173696 => 173697)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WTF/wtf/text/AtomicString.h        2014-09-17 18:27:42 UTC (rev 173696)
+++ trunk/Source/WTF/wtf/text/AtomicString.h        2014-09-17 20:01:09 UTC (rev 173697)
</span><span class="lines">@@ -123,7 +123,9 @@
</span><span class="cx">         { return m_string.find(s, start, caseSentitive); }
</span><span class="cx">     size_t find(const String&amp; s, unsigned start = 0, bool caseSentitive = true) const
</span><span class="cx">         { return m_string.find(s, start, caseSentitive); }
</span><del>-    
</del><ins>+    size_t find(CharacterMatchFunctionPtr matchFunction, unsigned start = 0) const
+        { return m_string.find(matchFunction, start); }
+
</ins><span class="cx">     bool startsWith(const String&amp; s, bool caseSensitive = true) const
</span><span class="cx">         { return m_string.startsWith(s, caseSensitive); }
</span><span class="cx">     bool startsWith(UChar character) const
</span></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (173696 => 173697)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog        2014-09-17 18:27:42 UTC (rev 173696)
+++ trunk/Source/WebCore/ChangeLog        2014-09-17 20:01:09 UTC (rev 173697)
</span><span class="lines">@@ -1,3 +1,42 @@
</span><ins>+2014-09-17  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
+
+        CSS value in whitespace-separated list attribute selector (~=) mishandles tab/newline/etc.
+        https://bugs.webkit.org/show_bug.cgi?id=136807
+
+        Reviewed by Antti Koivisto.
+
+        The spec defines selector lists as token separated by white space.
+
+        The definition of white space for CSS Selectors is:
+        &quot;White space in Selectors consists of the code points SPACE (U+0020),
+        TAB (U+0009), LINE FEED (U+000A), CARRIAGE RETURN (U+000D), and FORM FEED (U+000C)
+        can occur in whitespace. Other space-like code points, such as EM SPACE (U+2003)
+        and IDEOGRAPHIC SPACE (U+3000), are never part of white space.&quot;
+
+        The old code was only matching SPACE (U+0020) which is buggy. This patch
+        adds support for the other caracters.
+
+        Tests: fast/selectors/attr-list-01.html
+               fast/selectors/attribute-list-with-whitespace-in-selector.html
+               fast/selectors/attribute-list-with-whitespace-in-value.html
+
+        * css/SelectorChecker.cpp:
+        (WebCore::attributeValueMatches):
+        * cssjit/SelectorCompiler.cpp:
+        (WebCore::SelectorCompiler::constructFragments):
+        (WebCore::SelectorCompiler::attributeValueSpaceSeparetedListContains):
+        Add the missing checks.
+
+        * html/track/VTTRegion.cpp:
+        (WebCore::VTTRegion::setRegionSettings):
+        (WebCore::VTTRegion::parseSettingValue):
+        * html/track/WebVTTParser.cpp:
+        (WebCore::WebVTTParser::hasRequiredFileIdentifier):
+        (WebCore::WebVTTParser::collectTimingsAndSettings):
+        * html/track/WebVTTParser.h:
+        While looking for affected code, I discovered WebVTT redefines isHTMLSpace().
+        I cleaned that code.
+
</ins><span class="cx"> 2014-09-17  Gavin Barraclough  &lt;baraclough@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Aways have a PageThrottler (sometimes have a UserActivity::Impl)
</span></span></pre></div>
<a id="trunkSourceWebCorecssSelectorCheckercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/css/SelectorChecker.cpp (173696 => 173697)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/css/SelectorChecker.cpp        2014-09-17 18:27:42 UTC (rev 173696)
+++ trunk/Source/WebCore/css/SelectorChecker.cpp        2014-09-17 20:01:09 UTC (rev 173697)
</span><span class="lines">@@ -41,6 +41,7 @@
</span><span class="cx"> #include &quot;HTMLNames.h&quot;
</span><span class="cx"> #include &quot;HTMLOptGroupElement.h&quot;
</span><span class="cx"> #include &quot;HTMLOptionElement.h&quot;
</span><ins>+#include &quot;HTMLParserIdioms.h&quot;
</ins><span class="cx"> #include &quot;HTMLProgressElement.h&quot;
</span><span class="cx"> #include &quot;HTMLStyleElement.h&quot;
</span><span class="cx"> #include &quot;InsertionPoint.h&quot;
</span><span class="lines">@@ -371,8 +372,8 @@
</span><span class="cx">         break;
</span><span class="cx">     case CSSSelector::List:
</span><span class="cx">         {
</span><del>-            // Ignore empty selectors or selectors containing spaces
-            if (selectorValue.contains(' ') || selectorValue.isEmpty())
</del><ins>+            // Ignore empty selectors or selectors containing spaces.
+            if (selectorValue.isEmpty() || selectorValue.find(isHTMLSpace&lt;UChar&gt;) != notFound)
</ins><span class="cx">                 return false;
</span><span class="cx"> 
</span><span class="cx">             unsigned startSearchAt = 0;
</span><span class="lines">@@ -380,9 +381,9 @@
</span><span class="cx">                 size_t foundPos = value.find(selectorValue, startSearchAt, caseSensitive);
</span><span class="cx">                 if (foundPos == notFound)
</span><span class="cx">                     return false;
</span><del>-                if (!foundPos || value[foundPos - 1] == ' ') {
</del><ins>+                if (!foundPos || isHTMLSpace(value[foundPos - 1])) {
</ins><span class="cx">                     unsigned endStr = foundPos + selectorValue.length();
</span><del>-                    if (endStr == value.length() || value[endStr] == ' ')
</del><ins>+                    if (endStr == value.length() || isHTMLSpace(value[endStr]))
</ins><span class="cx">                         break; // We found a match.
</span><span class="cx">                 }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorecssjitSelectorCompilercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/cssjit/SelectorCompiler.cpp (173696 => 173697)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/cssjit/SelectorCompiler.cpp        2014-09-17 18:27:42 UTC (rev 173696)
+++ trunk/Source/WebCore/cssjit/SelectorCompiler.cpp        2014-09-17 20:01:09 UTC (rev 173697)
</span><span class="lines">@@ -37,6 +37,7 @@
</span><span class="cx"> #include &quot;FunctionCall.h&quot;
</span><span class="cx"> #include &quot;HTMLDocument.h&quot;
</span><span class="cx"> #include &quot;HTMLNames.h&quot;
</span><ins>+#include &quot;HTMLParserIdioms.h&quot;
</ins><span class="cx"> #include &quot;InspectorInstrumentation.h&quot;
</span><span class="cx"> #include &quot;NodeRenderStyle.h&quot;
</span><span class="cx"> #include &quot;QualifiedName.h&quot;
</span><span class="lines">@@ -777,7 +778,7 @@
</span><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx">         case CSSSelector::List:
</span><del>-            if (selector-&gt;value().contains(' '))
</del><ins>+            if (selector-&gt;value().find(isHTMLSpace&lt;UChar&gt;) != notFound)
</ins><span class="cx">                 return FunctionType::CannotMatchAnything;
</span><span class="cx">             FALLTHROUGH;
</span><span class="cx">         case CSSSelector::Begin:
</span><span class="lines">@@ -2252,9 +2253,9 @@
</span><span class="cx">             foundPos = value.findIgnoringCase(expectedString, startSearchAt);
</span><span class="cx">         if (foundPos == notFound)
</span><span class="cx">             return false;
</span><del>-        if (!foundPos || value[foundPos - 1] == ' ') {
</del><ins>+        if (!foundPos || isHTMLSpace(value[foundPos - 1])) {
</ins><span class="cx">             unsigned endStr = foundPos + expectedString-&gt;length();
</span><del>-            if (endStr == value.length() || value[endStr] == ' ')
</del><ins>+            if (endStr == value.length() || isHTMLSpace(value[endStr]))
</ins><span class="cx">                 return true;
</span><span class="cx">         }
</span><span class="cx">         startSearchAt = foundPos + 1;
</span></span></pre></div>
<a id="trunkSourceWebCorehtmltrackVTTRegioncpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/track/VTTRegion.cpp (173696 => 173697)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/track/VTTRegion.cpp        2014-09-17 18:27:42 UTC (rev 173696)
+++ trunk/Source/WebCore/html/track/VTTRegion.cpp        2014-09-17 20:01:09 UTC (rev 173697)
</span><span class="lines">@@ -39,6 +39,7 @@
</span><span class="cx"> #include &quot;ElementChildIterator.h&quot;
</span><span class="cx"> #include &quot;ExceptionCodePlaceholder.h&quot;
</span><span class="cx"> #include &quot;HTMLDivElement.h&quot;
</span><ins>+#include &quot;HTMLParserIdioms.h&quot;
</ins><span class="cx"> #include &quot;Logging.h&quot;
</span><span class="cx"> #include &quot;RenderElement.h&quot;
</span><span class="cx"> #include &quot;VTTCue.h&quot;
</span><span class="lines">@@ -233,7 +234,7 @@
</span><span class="cx"> 
</span><span class="cx">         // Verify that we're looking at a '='.
</span><span class="cx">         if (name == None || !input.scan('=')) {
</span><del>-            input.skipUntil&lt;WebVTTParser::isASpace&gt;();
</del><ins>+            input.skipUntil&lt;isHTMLSpace&lt;UChar&gt;&gt;();
</ins><span class="cx">             continue;
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="lines">@@ -269,7 +270,7 @@
</span><span class="cx"> {
</span><span class="cx">     DEPRECATED_DEFINE_STATIC_LOCAL(const AtomicString, scrollUpValueKeyword, (&quot;up&quot;, AtomicString::ConstructFromLiteral));
</span><span class="cx"> 
</span><del>-    VTTScanner::Run valueRun = input.collectUntil&lt;WebVTTParser::isASpace&gt;();
</del><ins>+    VTTScanner::Run valueRun = input.collectUntil&lt;isHTMLSpace&lt;UChar&gt;&gt;();
</ins><span class="cx"> 
</span><span class="cx">     switch (setting) {
</span><span class="cx">     case Id: {
</span></span></pre></div>
<a id="trunkSourceWebCorehtmltrackWebVTTParsercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/track/WebVTTParser.cpp (173696 => 173697)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/track/WebVTTParser.cpp        2014-09-17 18:27:42 UTC (rev 173696)
+++ trunk/Source/WebCore/html/track/WebVTTParser.cpp        2014-09-17 20:01:09 UTC (rev 173697)
</span><span class="lines">@@ -36,6 +36,7 @@
</span><span class="cx"> 
</span><span class="cx"> #include &quot;WebVTTParser.h&quot;
</span><span class="cx"> 
</span><ins>+#include &quot;HTMLParserIdioms.h&quot;
</ins><span class="cx"> #include &quot;ISOVTTCue.h&quot;
</span><span class="cx"> #include &quot;ProcessingInstruction.h&quot;
</span><span class="cx"> #include &quot;Text.h&quot;
</span><span class="lines">@@ -258,7 +259,7 @@
</span><span class="cx">     if (!line.startsWith(fileIdentifier, fileIdentifierLength))
</span><span class="cx">         return false;
</span><span class="cx"> 
</span><del>-    if (line.length() &gt; fileIdentifierLength &amp;&amp; !isASpace(line[fileIdentifierLength]))
</del><ins>+    if (line.length() &gt; fileIdentifierLength &amp;&amp; !isHTMLSpace(line[fileIdentifierLength]))
</ins><span class="cx">         return false;
</span><span class="cx">     return true;
</span><span class="cx"> }
</span><span class="lines">@@ -306,25 +307,25 @@
</span><span class="cx"> 
</span><span class="cx">     // Collect WebVTT cue timings and settings. (5.3 WebVTT cue timings and settings parsing.)
</span><span class="cx">     // Steps 1 - 3 - Let input be the string being parsed and position be a pointer into input
</span><del>-    input.skipWhile&lt;isASpace&gt;();
</del><ins>+    input.skipWhile&lt;isHTMLSpace&lt;UChar&gt;&gt;();
</ins><span class="cx"> 
</span><span class="cx">     // Steps 4 - 5 - Collect a WebVTT timestamp. If that fails, then abort and return failure. Otherwise, let cue's text track cue start time be the collected time.
</span><span class="cx">     if (!collectTimeStamp(input, m_currentStartTime))
</span><span class="cx">         return BadCue;
</span><span class="cx">     
</span><del>-    input.skipWhile&lt;isASpace&gt;();
</del><ins>+    input.skipWhile&lt;isHTMLSpace&lt;UChar&gt;&gt;();
</ins><span class="cx"> 
</span><span class="cx">     // Steps 6 - 9 - If the next three characters are not &quot;--&gt;&quot;, abort and return failure.
</span><span class="cx">     if (!input.scan(&quot;--&gt;&quot;))
</span><span class="cx">         return BadCue;
</span><span class="cx">     
</span><del>-    input.skipWhile&lt;isASpace&gt;();
</del><ins>+    input.skipWhile&lt;isHTMLSpace&lt;UChar&gt;&gt;();
</ins><span class="cx"> 
</span><span class="cx">     // Steps 10 - 11 - Collect a WebVTT timestamp. If that fails, then abort and return failure. Otherwise, let cue's text track cue end time be the collected time.
</span><span class="cx">     if (!collectTimeStamp(input, m_currentEndTime))
</span><span class="cx">         return BadCue;
</span><span class="cx"> 
</span><del>-    input.skipWhile&lt;isASpace&gt;();
</del><ins>+    input.skipWhile&lt;isHTMLSpace&lt;UChar&gt;&gt;();
</ins><span class="cx"> 
</span><span class="cx">     // Step 12 - Parse the WebVTT settings for the cue (conducted in TextTrackCue).
</span><span class="cx">     m_currentSettings = input.restOfInputAsString();
</span></span></pre></div>
<a id="trunkSourceWebCorehtmltrackWebVTTParserh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/track/WebVTTParser.h (173696 => 173697)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/track/WebVTTParser.h        2014-09-17 18:27:42 UTC (rev 173696)
+++ trunk/Source/WebCore/html/track/WebVTTParser.h        2014-09-17 20:01:09 UTC (rev 173697)
</span><span class="lines">@@ -122,11 +122,6 @@
</span><span class="cx">             || tagName == rtTag;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    static inline bool isASpace(UChar c)
-    {
-        // WebVTT space characters are U+0020 SPACE, U+0009 CHARACTER TABULATION (tab), U+000A LINE FEED (LF), U+000C FORM FEED (FF), and U+000D CARRIAGE RETURN    (CR).
-        return c == ' ' || c == '\t' || c == '\n' || c == '\f' || c == '\r';
-    }
</del><span class="cx">     static inline bool isValidSettingDelimiter(UChar c)
</span><span class="cx">     {
</span><span class="cx">         // ... a WebVTT cue consists of zero or more of the following components, in any order, separated from each other by one or more 
</span></span></pre>
</div>
</div>

</body>
</html>