Title: [153685] trunk
- Revision
- 153685
- Author
- [email protected]
- Date
- 2013-08-02 20:09:25 -0700 (Fri, 02 Aug 2013)
Log Message
REGRESSION (r153005): Crash in SpaceSplitString::spaceSplitStringContainsValue on Facebook
https://bugs.webkit.org/show_bug.cgi?id=119384
Patch by Benjamin Poulain <[email protected]> on 2013-08-02
Reviewed by Alexey Proskuryakov.
Source/WebCore:
When removing the "rel" attribute from HTMLAnchorElement, we parse the attribute for no value.
Following r153005, we no longer checked for null String, which caused a crash in that case.
Creating a SpaceSplitString from a null string causes the SpaceSplitString to be null. In that case
SpaceSplitString::contains() would always return false.
This patch modify SpaceSplitString::spaceSplitStringContainsValue() to follow the exact same
behavior.
Test: fast/dom/HTMLAnchorElement/remove-rel-attribute.html
* dom/SpaceSplitString.cpp:
(WebCore::SpaceSplitString::spaceSplitStringContainsValue):
LayoutTests:
* fast/dom/HTMLAnchorElement/remove-rel-attribute.html: Added.
* fast/dom/HTMLAnchorElement/remove-rel-attribute-expected.txt: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (153684 => 153685)
--- trunk/LayoutTests/ChangeLog 2013-08-03 00:54:19 UTC (rev 153684)
+++ trunk/LayoutTests/ChangeLog 2013-08-03 03:09:25 UTC (rev 153685)
@@ -1,3 +1,13 @@
+2013-08-02 Benjamin Poulain <[email protected]>
+
+ REGRESSION (r153005): Crash in SpaceSplitString::spaceSplitStringContainsValue on Facebook
+ https://bugs.webkit.org/show_bug.cgi?id=119384
+
+ Reviewed by Alexey Proskuryakov.
+
+ * fast/dom/HTMLAnchorElement/remove-rel-attribute.html: Added.
+ * fast/dom/HTMLAnchorElement/remove-rel-attribute-expected.txt: Added.
+
2013-08-02 Dean Jackson <[email protected]>
Force elements with perspective or preserve-3d to disallow direct composited backgrounds
Added: trunk/LayoutTests/fast/dom/HTMLAnchorElement/remove-rel-attribute-expected.txt (0 => 153685)
--- trunk/LayoutTests/fast/dom/HTMLAnchorElement/remove-rel-attribute-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/HTMLAnchorElement/remove-rel-attribute-expected.txt 2013-08-03 03:09:25 UTC (rev 153685)
@@ -0,0 +1,9 @@
+Verify that removing the "rel" attribute from an anchor element does not cause a crash.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+WebKit
Added: trunk/LayoutTests/fast/dom/HTMLAnchorElement/remove-rel-attribute.html (0 => 153685)
--- trunk/LayoutTests/fast/dom/HTMLAnchorElement/remove-rel-attribute.html (rev 0)
+++ trunk/LayoutTests/fast/dom/HTMLAnchorElement/remove-rel-attribute.html 2013-08-03 03:09:25 UTC (rev 153685)
@@ -0,0 +1,14 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<a id=target href="" rel=noreferrer>WebKit</a>
+<script>
+description("Verify that removing the \"rel\" attribute from an anchor element does not cause a crash.")
+document.getElementById('target').removeAttribute('rel');
+</script>
+<script src=""
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (153684 => 153685)
--- trunk/Source/WebCore/ChangeLog 2013-08-03 00:54:19 UTC (rev 153684)
+++ trunk/Source/WebCore/ChangeLog 2013-08-03 03:09:25 UTC (rev 153685)
@@ -1,3 +1,23 @@
+2013-08-02 Benjamin Poulain <[email protected]>
+
+ REGRESSION (r153005): Crash in SpaceSplitString::spaceSplitStringContainsValue on Facebook
+ https://bugs.webkit.org/show_bug.cgi?id=119384
+
+ Reviewed by Alexey Proskuryakov.
+
+ When removing the "rel" attribute from HTMLAnchorElement, we parse the attribute for no value.
+ Following r153005, we no longer checked for null String, which caused a crash in that case.
+
+ Creating a SpaceSplitString from a null string causes the SpaceSplitString to be null. In that case
+ SpaceSplitString::contains() would always return false.
+ This patch modify SpaceSplitString::spaceSplitStringContainsValue() to follow the exact same
+ behavior.
+
+ Test: fast/dom/HTMLAnchorElement/remove-rel-attribute.html
+
+ * dom/SpaceSplitString.cpp:
+ (WebCore::SpaceSplitString::spaceSplitStringContainsValue):
+
2013-08-02 Dean Jackson <[email protected]>
Force elements with perspective or preserve-3d to disallow direct composited backgrounds
Modified: trunk/Source/WebCore/dom/SpaceSplitString.cpp (153684 => 153685)
--- trunk/Source/WebCore/dom/SpaceSplitString.cpp 2013-08-03 00:54:19 UTC (rev 153684)
+++ trunk/Source/WebCore/dom/SpaceSplitString.cpp 2013-08-03 03:09:25 UTC (rev 153685)
@@ -213,6 +213,9 @@
bool SpaceSplitString::spaceSplitStringContainsValue(const String& inputString, const char* value, unsigned valueLength, bool shouldFoldCase)
{
+ if (inputString.isNull())
+ return false;
+
String string = inputString;
if (shouldFoldCase && hasNonASCIIOrUpper(string))
string = string.foldCase();
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
