Bug 111248 – constructTreeFromCompactHTMLToken should call clearExternalCharacters

• Component: New Bugs
• Status: RESOLVED FIXED

[Eric Seidel (no email)]

constructTreeFromCompactHTMLToken should call clearExternalCharacters

[Eric Seidel (no email)]

Created attachment 191102 [details]
Patch

[Eric Seidel (no email)]

I don't believe this causes any behavior change, but it's possible this is why we were passing that inspector view-source test better with the threaded parser.

In order to have this be a problem, we would have to push a token onto the TreeBuilder's item-stack, and then end the chuck, and then somehow cause item()->token()->characters() to be accessed while parsing the next chunk.

[Eric Seidel (no email)]

This whole design is wrong for HTMLCompactToken.  We shouldn't need a heap allocated AtomicHTMLToken anyway.  We should replace it with a stack-allocated object which knows how to hang onto the necessary data when copied into an HTMLStackItem.

[Adam Barth]

Comment on attachment 191102 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=191102&action=review

> Source/WebCore/ChangeLog:10
> +        I don't know how to write a test for this.  It's possible characters()
> +        is never accessed from HTMLStackItem::token(), but it's better to be
> +        safe than sorry here.

Yeah, there isn't any behavior change from this patch, but it's worth doing anyway.

> Source/WebCore/html/parser/HTMLDocumentParser.cpp:573
> +    token->clearExternalCharacters(); // The compact token could be destroyed any time after this method returns.

Yeah, we do the same thing in HTMLDocumentParser::constructTreeFromHTMLToken

[WebKit Review Bot]

Comment on attachment 191102 [details]
Patch

Clearing flags on attachment: 191102

Committed r144543: <http://trac.webkit.org/changeset/144543>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.