Attachment 11032 Details for Bug 11221 – Improved patch

[patch] Improved patch

11221-3.diff (text/plain), 5.32 KB, created by Rob Buis on 2006-10-11 10:58:39 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Rob Buis

Created: 2006-10-11 10:58:39 PDT

Size: 5.32 KB

patch

obsolete

>Index: LayoutTests/ChangeLog
>===================================================================
>--- LayoutTests/ChangeLog	(revision 16989)
>+++ LayoutTests/ChangeLog	(working copy)
>@@ -1,3 +1,14 @@
>+2006-10-11  Rob Buis  <buis@kde.org>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Testcase for:
>+        http://bugs.webkit.org/show_bug.cgi?id=11221
>+        REGRESSION: iExploder crash due to style="cursor: url()"
>+
>+        * fast/css/invalid-cursor-property-crash-expected.txt: Added.
>+        * fast/css/invalid-cursor-property-crash.html: Added.
>+
> 2006-10-11  Antti Koivisto  <koivisto@iki.fi>
> 
>         Reviewed by Hyatt.
>Index: LayoutTests/fast/css/invalid-cursor-property-crash-expected.txt
>===================================================================
>--- LayoutTests/fast/css/invalid-cursor-property-crash-expected.txt	(revision 0)
>+++ LayoutTests/fast/css/invalid-cursor-property-crash-expected.txt	(revision 0)
>@@ -0,0 +1,3 @@
>+This tests that the invalid cursor property value does not get applied. See Bug 11221.
>+SUCCESS
>+
>Index: LayoutTests/fast/css/invalid-cursor-property-crash.html
>===================================================================
>--- LayoutTests/fast/css/invalid-cursor-property-crash.html	(revision 0)
>+++ LayoutTests/fast/css/invalid-cursor-property-crash.html	(revision 0)
>@@ -0,0 +1,21 @@
>+<html>
>+<head>
>+    <script>
>+    function runTest() {
>+        if (window.layoutTestController)
>+            layoutTestController.dumpAsText();
>+            
>+        var d = document.getElementById('theDiv');
>+        var style = document.defaultView.getComputedStyle(d, '');
>+        
>+        if (style && style.cursor == 'auto')
>+            document.getElementById('result').innerHTML = 'SUCCESS';            
>+    }
>+    </script>
>+</head>
>+<body onload="runTest()">
>+<div id="theDiv" style="cursor: url()">
>+<div>This tests that the invalid cursor property value does not get applied. See Bug 11221.</div>
>+<div id="result">FAILURE</div>
>+</body>
>+</html>
>Index: WebCore/ChangeLog
>===================================================================
>--- WebCore/ChangeLog	(revision 16989)
>+++ WebCore/ChangeLog	(working copy)
>@@ -1,3 +1,17 @@
>+2006-10-11  Rob Buis  <buis@kde.org>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        http://bugs.webkit.org/show_bug.cgi?id=11221
>+        REGRESSION: iExploder crash due to style="cursor: url()"
>+
>+        Take better care of empty cursor lists.
>+
>+        Test: fast/css/invalid-cursor-property-crash.html
>+
>+        * css/cssparser.cpp:
>+        (WebCore::CSSParser::parseValue):
>+
> 2006-10-11  Adam Roben  <aroben@apple.com>
> 
>         Fix Windows build.
>Index: WebCore/css/cssparser.cpp
>===================================================================
>--- WebCore/css/cssparser.cpp	(revision 16989)
>+++ WebCore/css/cssparser.cpp	(working copy)
>@@ -702,6 +702,8 @@ bool CSSParser::parseValue(int propId, b
>         // ns-resize | nesw-resize | nwse-resize | col-resize | row-resize | text | wait | help ] ] | inherit
>         CSSValueList* list = 0;
>         while (value && value->unit == CSSPrimitiveValue::CSS_URI) {
>+            if (!list)
>+                list = new CSSValueList; 
>             String uri = parseURL(domString(value->string));
>             Vector<int> coords;
>             value = valueList->next();
>@@ -720,28 +722,28 @@ bool CSSParser::parseValue(int propId, b
>                 hotspot = IntPoint(coords[0], coords[1]);
>             if (strict || coords.size() == 0) {
> #ifdef SVG_SUPPORT
>-            if (uri.startsWith("#")) {
>-                if (!list)
>-                    list = new CSSValueList; 
>-                list->append(new CSSPrimitiveValue(uri, CSSPrimitiveValue::CSS_URI));
>-            } else
>+                if (uri.startsWith("#"))
>+                    list->append(new CSSPrimitiveValue(uri, CSSPrimitiveValue::CSS_URI));
>+                else
> #endif
>-            if (!uri.isEmpty()) {
>-                if (!list)
>-                    list = new CSSValueList; 
>-                list->append(new CSSCursorImageValue(
>-                             String(KURL(styleElement->baseURL().deprecatedString(), uri.deprecatedString()).url()),
>-                             hotspot, styleElement));
>-            }
>+                if (!uri.isEmpty()) {
>+                    list->append(new CSSCursorImageValue(
>+                                 String(KURL(styleElement->baseURL().deprecatedString(), uri.deprecatedString()).url()),
>+                                 hotspot, styleElement));
>+                }
>             }
>-            if ((strict && !value) || (value && !(value->unit == Value::Operator && value->iValue == ',')))
>+            if ((strict && !value) || (value && !(value->unit == Value::Operator && value->iValue == ','))) {
>+                delete list;
>                 return false;
>+            }
>             value = valueList->next(); // comma
>         }
>         if (list) {
>             if (!value) { // no value after url list (MSIE 5 compatibility)
>-                if (list->length() > 1)
>+                if (list->length() != 1) {
>+                    delete list;
>                     return false;
>+                }
>             } else if (!strict && value->id == CSS_VAL_HAND) // MSIE 5 compatibility :/
>                 list->append(new CSSPrimitiveValue(CSS_VAL_POINTER));
>             else if (value && value->id >= CSS_VAL_AUTO && value->id <= CSS_VAL_HELP)

Flags:

mitz: review+

Actions: View | Formatted Diff | Diff

Attachments on bug 11221: 10983 | 10984 | 10985 | 11021 | 11031 | 11032