Title: [156222] trunk
- Revision
- 156222
- Author
- [email protected]
- Date
- 2013-09-20 21:13:52 -0700 (Fri, 20 Sep 2013)
Log Message
Bad cast from CSSInitialValue to CSSValueList
https://bugs.webkit.org/show_bug.cgi?id=121729
Source/WebCore:
Reviewed by Beth Dakin.
Merge https://chromium.googlesource.com/chromium/blink/+/fcfaa51f9207b32cffe751c1a1380a921e464cbb
The issue was that we would cast to CSSValueList without checking
the type of the CSSValue. After this change, we use the ASSERT'ing
cast and explicitly check the type of the CSSValue before the cast.
Test: fast/css/crash-inherit-value-font-family.html
* css/CSSParser.cpp:
(WebCore::CSSParser::parseFontFaceValue):
LayoutTests:
Reviewed by Beth Dakin.
Add a regression test. This is not a merge since the test in the Blink change involves
superfluous execCommand calls.
* fast/css/crash-inherit-value-font-family-expected.txt: Added.
* fast/css/crash-inherit-value-font-family.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (156221 => 156222)
--- trunk/LayoutTests/ChangeLog 2013-09-21 04:11:28 UTC (rev 156221)
+++ trunk/LayoutTests/ChangeLog 2013-09-21 04:13:52 UTC (rev 156222)
@@ -1,3 +1,16 @@
+2013-09-20 Ryosuke Niwa <[email protected]>
+
+ Bad cast from CSSInitialValue to CSSValueList
+ https://bugs.webkit.org/show_bug.cgi?id=121729
+
+ Reviewed by Beth Dakin.
+
+ Add a regression test. This is not a merge since the test in the Blink change involves
+ superfluous execCommand calls.
+
+ * fast/css/crash-inherit-value-font-family-expected.txt: Added.
+ * fast/css/crash-inherit-value-font-family.html: Added.
+
2013-09-20 Alexandru Chiculita <[email protected]>
Web Inspector: [CSS Regions] Display CSS Regions chain when highlighting a CSS Region node
Added: trunk/LayoutTests/fast/css/crash-inherit-value-font-family-expected.txt (0 => 156222)
--- trunk/LayoutTests/fast/css/crash-inherit-value-font-family-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/css/crash-inherit-value-font-family-expected.txt 2013-09-21 04:13:52 UTC (rev 156222)
@@ -0,0 +1,3 @@
+WebKit shouldn't crash on font face values "initial" and "inherit". You should see PASS below.
+
+PASS
Added: trunk/LayoutTests/fast/css/crash-inherit-value-font-family.html (0 => 156222)
--- trunk/LayoutTests/fast/css/crash-inherit-value-font-family.html (rev 0)
+++ trunk/LayoutTests/fast/css/crash-inherit-value-font-family.html 2013-09-21 04:13:52 UTC (rev 156222)
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>WebKit shouldn't crash on font face values "initial" and "inherit". You should see PASS below.</p>
+<font face="inherit"></font>
+<font face="initial"></font>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+document.write('PASS');
+</script>
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (156221 => 156222)
--- trunk/Source/WebCore/ChangeLog 2013-09-21 04:11:28 UTC (rev 156221)
+++ trunk/Source/WebCore/ChangeLog 2013-09-21 04:13:52 UTC (rev 156222)
@@ -1,3 +1,21 @@
+2013-09-20 Ryosuke Niwa <[email protected]>
+
+ Bad cast from CSSInitialValue to CSSValueList
+ https://bugs.webkit.org/show_bug.cgi?id=121729
+
+ Reviewed by Beth Dakin.
+
+ Merge https://chromium.googlesource.com/chromium/blink/+/fcfaa51f9207b32cffe751c1a1380a921e464cbb
+
+ The issue was that we would cast to CSSValueList without checking
+ the type of the CSSValue. After this change, we use the ASSERT'ing
+ cast and explicitly check the type of the CSSValue before the cast.
+
+ Test: fast/css/crash-inherit-value-font-family.html
+
+ * css/CSSParser.cpp:
+ (WebCore::CSSParser::parseFontFaceValue):
+
2013-09-20 Zoltan Horvath <[email protected]>
Remove includes from LineWidth.h
Modified: trunk/Source/WebCore/css/CSSParser.cpp (156221 => 156222)
--- trunk/Source/WebCore/css/CSSParser.cpp 2013-09-21 04:11:28 UTC (rev 156221)
+++ trunk/Source/WebCore/css/CSSParser.cpp 2013-09-21 04:13:52 UTC (rev 156222)
@@ -1297,7 +1297,11 @@
RefPtr<MutableStylePropertySet> dummyStyle = MutableStylePropertySet::create();
if (!parseValue(dummyStyle.get(), CSSPropertyFontFamily, string, false, CSSQuirksMode, 0))
return 0;
- return static_pointer_cast<CSSValueList>(dummyStyle->getPropertyCSSValue(CSSPropertyFontFamily));
+
+ RefPtr<CSSValue> fontFamily = dummyStyle->getPropertyCSSValue(CSSPropertyFontFamily);
+ if (!fontFamily->isValueList())
+ return 0; // FIXME: "initial" and "inherit" should be parsed as font names in the face attribute.
+ return static_pointer_cast<CSSValueList>(fontFamily.release());
}
#if ENABLE(CSS_VARIABLES)
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
