- Revision
- 184183
- Author
- [email protected]
- Date
- 2015-05-12 02:01:07 -0700 (Tue, 12 May 2015)
Log Message
Merge r183948 - Fix sizes crash and add invalid value tests.
https://bugs.webkit.org/show_bug.cgi?id=144739
Reviewed by Darin Adler.
Source/WebCore:
Make sure that only CSS length are allowed when the sizes parser is calling computeLength.
Also make sure that for invalid lengths, the 100vw default is used instead.
Test: fast/dom/HTMLImageElement/sizes/image-sizes-invalids.html
* css/SourceSizeList.cpp:
(WebCore::computeLength):
(WebCore::defaultLength):
(WebCore::parseSizesAttribute):
LayoutTests:
Add tests that make sure that invalid values are properly handled, and a 100vw
source-size length is being used for srcset and for intrinsic dimension calculation.
* fast/dom/HTMLImageElement/sizes/image-sizes-invalids-expected.txt: Added.
* fast/dom/HTMLImageElement/sizes/image-sizes-invalids.html: Added.
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.8/LayoutTests/ChangeLog (184182 => 184183)
--- releases/WebKitGTK/webkit-2.8/LayoutTests/ChangeLog 2015-05-12 09:00:00 UTC (rev 184182)
+++ releases/WebKitGTK/webkit-2.8/LayoutTests/ChangeLog 2015-05-12 09:01:07 UTC (rev 184183)
@@ -1,3 +1,16 @@
+2015-05-07 Yoav Weiss <[email protected]>
+
+ Fix sizes crash and add invalid value tests.
+ https://bugs.webkit.org/show_bug.cgi?id=144739
+
+ Reviewed by Darin Adler.
+
+ Add tests that make sure that invalid values are properly handled, and a 100vw
+ source-size length is being used for srcset and for intrinsic dimension calculation.
+
+ * fast/dom/HTMLImageElement/sizes/image-sizes-invalids-expected.txt: Added.
+ * fast/dom/HTMLImageElement/sizes/image-sizes-invalids.html: Added.
+
2015-05-04 Chris Dumez <[email protected]>
Crash at com.apple.WebKit.WebContent at com.apple.WebCore: WebCore::createWindow + 185
Added: releases/WebKitGTK/webkit-2.8/LayoutTests/fast/dom/HTMLImageElement/sizes/image-sizes-invalids-expected.txt (0 => 184183)
--- releases/WebKitGTK/webkit-2.8/LayoutTests/fast/dom/HTMLImageElement/sizes/image-sizes-invalids-expected.txt (rev 0)
+++ releases/WebKitGTK/webkit-2.8/LayoutTests/fast/dom/HTMLImageElement/sizes/image-sizes-invalids-expected.txt 2015-05-12 09:01:07 UTC (rev 184183)
@@ -0,0 +1,16 @@
+PASS document.getElementById(elementId).clientWidth is 800
+PASS currentSrcFileName(elementId) is "image-set-2x.png"
+PASS document.getElementById(elementId).clientWidth is 800
+PASS currentSrcFileName(elementId) is "image-set-2x.png"
+PASS document.getElementById(elementId).clientWidth is 800
+PASS currentSrcFileName(elementId) is "image-set-2x.png"
+PASS document.getElementById(elementId).clientWidth is 800
+PASS currentSrcFileName(elementId) is "image-set-2x.png"
+PASS document.getElementById(elementId).clientWidth is 800
+PASS currentSrcFileName(elementId) is "image-set-2x.png"
+PASS document.getElementById(elementId).clientWidth is 800
+PASS currentSrcFileName(elementId) is "image-set-2x.png"
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: releases/WebKitGTK/webkit-2.8/LayoutTests/fast/dom/HTMLImageElement/sizes/image-sizes-invalids.html (0 => 184183)
--- releases/WebKitGTK/webkit-2.8/LayoutTests/fast/dom/HTMLImageElement/sizes/image-sizes-invalids.html (rev 0)
+++ releases/WebKitGTK/webkit-2.8/LayoutTests/fast/dom/HTMLImageElement/sizes/image-sizes-invalids.html 2015-05-12 09:01:07 UTC (rev 184183)
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<script src=""
+<script src=""
+<script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+
+ var elementId;
+ addEventListener("load", function() {
+ for (var i = 1; i < 7; ++i) {
+ elementId = "crash" + i;
+ shouldBe('document.getElementById(elementId).clientWidth', '800');
+ shouldBe('currentSrcFileName(elementId)', '"image-set-2x.png"');
+ }
+ }, false);
+</script>
+<!-- crash tests -->
+<img id="crash1" sizes="1q" srcset="../../../hidpi/resources/image-set-2x.png 800w, ../resources/image-set-4x.png 16000w">
+<img id="crash1" sizes="1pxllll" srcset="../../../hidpi/resources/image-set-2x.png 800w, ../resources/image-set-4x.png 16000w">
+<img id="crash2" sizes="1dfsdf4534fddd" srcset="../../../hidpi/resources/image-set-2x.png 800w, ../resources/image-set-4x.png 16000w">
+<img id="crash3" sizes="calc()" srcset="../../../hidpi/resources/image-set-2x.png 800w, ../resources/image-set-4x.png 16000w">
+<img id="crash4" sizes="calc(3q)" srcset="../../../hidpi/resources/image-set-2x.png 800w, ../resources/image-set-4x.png 16000w">
+<img id="crash4" sizes="calcssdff()" srcset="../../../hidpi/resources/image-set-2x.png 800w, ../resources/image-set-4x.png 16000w">
+<img id="crash5" sizes="calc(2px+dfmjbsf,,,skidkk)" srcset="../../../hidpi/resources/image-set-2x.png 800w, ../resources/image-set-4x.png 16000w">
+<img id="crash6" sizes="calc(2px+dfmjbsf,,,skidkk) + 2px, 56px" srcset="../../../hidpi/resources/image-set-2x.png 800w, ../resources/image-set-4x.png 16000w">
Modified: releases/WebKitGTK/webkit-2.8/Source/WebCore/ChangeLog (184182 => 184183)
--- releases/WebKitGTK/webkit-2.8/Source/WebCore/ChangeLog 2015-05-12 09:00:00 UTC (rev 184182)
+++ releases/WebKitGTK/webkit-2.8/Source/WebCore/ChangeLog 2015-05-12 09:01:07 UTC (rev 184183)
@@ -1,3 +1,20 @@
+2015-05-07 Yoav Weiss <[email protected]>
+
+ Fix sizes crash and add invalid value tests.
+ https://bugs.webkit.org/show_bug.cgi?id=144739
+
+ Reviewed by Darin Adler.
+
+ Make sure that only CSS length are allowed when the sizes parser is calling computeLength.
+ Also make sure that for invalid lengths, the 100vw default is used instead.
+
+ Test: fast/dom/HTMLImageElement/sizes/image-sizes-invalids.html
+
+ * css/SourceSizeList.cpp:
+ (WebCore::computeLength):
+ (WebCore::defaultLength):
+ (WebCore::parseSizesAttribute):
+
2015-05-06 David Hyatt <[email protected]>
Avoid copies in scrollOffsetForFixedPosition() and inline it.
Modified: releases/WebKitGTK/webkit-2.8/Source/WebCore/css/SourceSizeList.cpp (184182 => 184183)
--- releases/WebKitGTK/webkit-2.8/Source/WebCore/css/SourceSizeList.cpp 2015-05-12 09:00:00 UTC (rev 184182)
+++ releases/WebKitGTK/webkit-2.8/Source/WebCore/css/SourceSizeList.cpp 2015-05-12 09:01:07 UTC (rev 184183)
@@ -56,16 +56,25 @@
return mediaQueryEvaluator.eval(mediaQuerySet.get());
}
+static unsigned defaultLength(RenderStyle& style, RenderView* view)
+{
+ return CSSPrimitiveValue::create(100, CSSPrimitiveValue::CSS_VW)->computeLength<unsigned>(CSSToLengthConversionData(&style, &style, view));
+}
+
static unsigned computeLength(CSSValue* value, RenderStyle& style, RenderView* view)
{
CSSToLengthConversionData conversionData(&style, &style, view);
- if (is<CSSPrimitiveValue>(value))
- return downcast<CSSPrimitiveValue>(*value).computeLength<unsigned>(conversionData);
+ if (is<CSSPrimitiveValue>(value)) {
+ CSSPrimitiveValue& primitiveValue = downcast<CSSPrimitiveValue>(*value);
+ if (!primitiveValue.isLength())
+ return defaultLength(style, view);
+ return primitiveValue.computeLength<unsigned>(conversionData);
+ }
if (is<CSSCalcValue>(value)) {
Length length(downcast<CSSCalcValue>(*value).createCalculationValue(conversionData));
return CSSPrimitiveValue::create(length, &style)->computeLength<unsigned>(conversionData);
}
- return 0;
+ return defaultLength(style, view);
}
unsigned parseSizesAttribute(StringView sizesAttribute, RenderView* view, Frame* frame)
@@ -77,7 +86,7 @@
if (match(WTF::move(sourceSize._expression_), style, frame))
return computeLength(sourceSize.length.get(), style, view);
}
- return computeLength(CSSPrimitiveValue::create(100, CSSPrimitiveValue::CSS_VW).ptr(), style, view);
+ return defaultLength(style, view);
}
#endif
