Attachment 11021 Details for Bug 11221 – Potential fix

[patch] Potential fix

11221.diff (text/plain), 2.63 KB, created by Rob Buis on 2006-10-10 13:20:29 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Rob Buis

Created: 2006-10-10 13:20:29 PDT

Size: 2.63 KB

patch

obsolete

>Index: WebCore/ChangeLog
>===================================================================
>--- WebCore/ChangeLog	(revision 16971)
>+++ WebCore/ChangeLog	(working copy)
>@@ -1,3 +1,17 @@
>+2006-10-10  Rob Buis  <buis@kde.org>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        http://bugs.webkit.org/show_bug.cgi?id=11221
>+        REGRESSION: iExploder crash due to style="cursor: url()"
>+
>+        Take better care of empty cursor lists.
>+
>+        WARNING: NO TEST CASES ADDED OR CHANGED
>+
>+        * css/cssparser.cpp:
>+        (WebCore::CSSParser::parseValue):
>+
> 2006-10-10  Maciej Stachowiak  <mjs@apple.com>
> 
>         Reviewed by Mitz.
>Index: WebCore/css/cssparser.cpp
>===================================================================
>--- WebCore/css/cssparser.cpp	(revision 16971)
>+++ WebCore/css/cssparser.cpp	(working copy)
>@@ -702,6 +702,7 @@ bool CSSParser::parseValue(int propId, b
>         // ns-resize | nesw-resize | nwse-resize | col-resize | row-resize | text | wait | help ] ] | inherit
>         CSSValueList* list = 0;
>         while (value && value->unit == CSSPrimitiveValue::CSS_URI) {
>+            list = new CSSValueList; 
>             String uri = parseURL(domString(value->string));
>             Vector<int> coords;
>             value = valueList->next();
>@@ -720,15 +721,11 @@ bool CSSParser::parseValue(int propId, b
>                 hotspot = IntPoint(coords[0], coords[1]);
>             if (strict || coords.size() == 0) {
> #ifdef SVG_SUPPORT
>-            if (uri.startsWith("#")) {
>-                if (!list)
>-                    list = new CSSValueList; 
>+            if (uri.startsWith("#"))
>                 list->append(new CSSPrimitiveValue(uri, CSSPrimitiveValue::CSS_URI));
>-            } else
>+            else
> #endif
>             if (!uri.isEmpty()) {
>-                if (!list)
>-                    list = new CSSValueList; 
>                 list->append(new CSSCursorImageValue(
>                              String(KURL(styleElement->baseURL().deprecatedString(), uri.deprecatedString()).url()),
>                              hotspot, styleElement));
>@@ -740,8 +737,10 @@ bool CSSParser::parseValue(int propId, b
>         }
>         if (list) {
>             if (!value) { // no value after url list (MSIE 5 compatibility)
>-                if (list->length() > 1)
>+                if (list->length() != 1) {
>+                    delete list;
>                     return false;
>+                }
>             } else if (!strict && value->id == CSS_VAL_HAND) // MSIE 5 compatibility :/
>                 list->append(new CSSPrimitiveValue(CSS_VAL_POINTER));
>             else if (value && value->id >= CSS_VAL_AUTO && value->id <= CSS_VAL_HELP)

Actions: View | Formatted Diff | Diff

Attachments on bug 11221: 10983 | 10984 | 10985 | 11021 | 11031 | 11032