103317 2012-11-26 16:32:15 -0800 HTML/XML parser helper unconsumeCharacters() can push back 8 bit text as 16 bit text 2012-11-26 19:00:50 -0800 1 1 1 Unclassified WebKit DOM 528+ (Nightly build) All All RESOLVED FIXED P2 Normal --- 1 msaboff msaboff webkit.review.bot oldest_to_newest 776046 0 msaboff 2012-11-26 16:32:15 -0800 For greater than 2 character push back, unconsumeCharacters() in WebCore/xml/parser/CharacterReferenceParserInlines.h extracts text from the StringBuilder argument as a 16 bit string even if the StringBuilder contains 8 bit text. Instead, the StringBuilder should be stringified and used directly. 776059 1 176108 msaboff 2012-11-26 16:40:48 -0800 Created attachment 176108 Patch 776210 2 176108 webkit.review.bot 2012-11-26 19:00:47 -0800 Comment on attachment 176108 Patch Clearing flags on attachment: 176108 Committed r135802: <http://trac.webkit.org/changeset/135802> 776211 3 webkit.review.bot 2012-11-26 19:00:50 -0800 All reviewed patches have been landed. Closing bug. 176108 2012-11-26 16:40:48 -0800 2012-11-26 19:00:46 -0800 Patch 103317.patch text/plain 1682 msaboff SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDEzNTc4NikKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE5IEBACisyMDEyLTExLTI2ICBNaWNoYWVs IFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAgICAgIEhUTUwvWE1MIHBhcnNlciBo ZWxwZXIgdW5jb25zdW1lQ2hhcmFjdGVycygpIGNhbiBwdXNoIGJhY2sgOCBiaXQgdGV4dCBhcyAx NiBiaXQgdGV4dAorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/ aWQ9MTAzMzE3CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAg ICAgQ2hhbmdlZCB0byB1c2UgdGhlIFN0cmluZyBkaXJlY3RseSBmcm9tIHRoZSBTdHJpbmdCdWls ZGVyIGluc3RlYWQgb2YgY3JlYXRpbmcgb3VyIG93bi4KKyAgICAgICAgVXNlZCB0b1N0cmluZ1By ZXNlcnZlQ2FwYWNpdHkoKSBpbiBjYXNlIHRoZSBjYWxsZXIgbWF5IHdhbnQgdG8gYWRkIHRvIHRo ZSBTdHJpbmdCdWlsZGVyCisgICAgICAgIGV2ZW4gdGhvdWdoIGN1cnJlbnQgY2FsbGVycyBkb24n dC4KKworICAgICAgICBObyBuZXcgdGVzdHMuIE5vIGNoYW5nZSBpbiBmdW5jdGlvbmFsaXR5Lgor CisgICAgICAgICogeG1sL3BhcnNlci9DaGFyYWN0ZXJSZWZlcmVuY2VQYXJzZXJJbmxpbmVzLmg6 CisgICAgICAgIChXZWJDb3JlOjp1bmNvbnN1bWVDaGFyYWN0ZXJzKToKKwogMjAxMi0xMS0yNiAg SmFtZXMgU2ltb25zZW4gIDxzaW1vbmphbUBjaHJvbWl1bS5vcmc+CiAKICAgICAgICAgQ29uc29s aWRhdGUgRnJhbWVMb2FkZXI6OmxvYWQoKSBpbnRvIG9uZSBmdW5jdGlvbiB0YWtpbmcgYSBGcmFt ZUxvYWRSZXF1ZXN0CkluZGV4OiBTb3VyY2UvV2ViQ29yZS94bWwvcGFyc2VyL0NoYXJhY3RlclJl ZmVyZW5jZVBhcnNlcklubGluZXMuaAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2ViQ29yZS94bWwv cGFyc2VyL0NoYXJhY3RlclJlZmVyZW5jZVBhcnNlcklubGluZXMuaAkocmV2aXNpb24gMTM1NjQw KQorKysgU291cmNlL1dlYkNvcmUveG1sL3BhcnNlci9DaGFyYWN0ZXJSZWZlcmVuY2VQYXJzZXJJ bmxpbmVzLmgJKHdvcmtpbmcgY29weSkKQEAgLTQ0LDcgKzQ0LDcgQEAgaW5saW5lIHZvaWQgdW5j b25zdW1lQ2hhcmFjdGVycyhTZWdtZW50ZQogICAgICAgICBzb3VyY2UucHVzaChjb25zdW1lZENo YXJhY3RlcnNbMF0pOwogICAgICAgICBzb3VyY2UucHVzaChjb25zdW1lZENoYXJhY3RlcnNbMV0p OwogICAgIH0gZWxzZQotICAgICAgICBzb3VyY2UucHJlcGVuZChTZWdtZW50ZWRTdHJpbmcoU3Ry aW5nKGNvbnN1bWVkQ2hhcmFjdGVycy5jaGFyYWN0ZXJzKCksIGNvbnN1bWVkQ2hhcmFjdGVycy5s ZW5ndGgoKSkpKTsKKyAgICAgICAgc291cmNlLnByZXBlbmQoU2VnbWVudGVkU3RyaW5nKGNvbnN1 bWVkQ2hhcmFjdGVycy50b1N0cmluZ1ByZXNlcnZlQ2FwYWNpdHkoKSkpOwogfQogCiB0ZW1wbGF0 ZSA8dHlwZW5hbWUgUGFyc2VyRnVuY3Rpb25zPgo=